Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,781 total · sorted newest first- Jul 9, 2026
Malicious code in chai-as-modified (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-as-buffered (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-await-dom (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-as-staged (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chain-chai-async (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-as-align (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-promised-test (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chain-chai-await (npm)
3 compromised versions
- Jul 9, 2026
Malicious code in chai-as-serialized (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-as-thread (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-as-balanced (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-deflect (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in chai-as-sharpened (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-secure (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in chai-smart (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-as-disarmed (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-defender (npm)
6 compromised versions
- Jul 9, 2026
Malicious code in tailwind-animate-v4 (npm)
4 compromised versions
- Jul 9, 2026
Malicious code in chai-as-smart (npm)
1 compromised version
- Jul 9, 2026
Malicious code in @wagni_bot/jupiter-sdk (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/pumpfun-sdk (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/orca-sdk (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/hyperliquid-sdk (npm)
7 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/bsc-sdk (npm)
7 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/polymarket-sdk (npm)
7 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/opensea-sdk (npm)
7 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/eth-agent (npm)
7 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/binance-sdk (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/solana-sdk (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/meteora-sdk (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/polygon-sdk (npm)
7 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/metemask-sdk (npm)
7 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/web3-agent (npm)
6 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/ethereum-wallet (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in @wagni_bot/web3-toolkit (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in txs-builder-lib (npm)
3 compromised versions
- Jul 9, 2026
Malicious code in client-cookies-agent (npm)
3 compromised versions
- Jul 9, 2026
Malicious code in playwrightr (PyPI)
2 compromised versions
- Jul 9, 2026
Malicious code in n8n-nodes-mcputils (npm)
1 compromised version
- Jul 9, 2026
Malicious code in mchain-sdk (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chain-api-sdk (npm)
3 compromised versions
- Jul 9, 2026
Malicious code in testing-d3do (npm)
1 compromised version
- Jul 9, 2026
Malicious code in security-console-ui (npm)
- Jul 9, 2026
Malicious code in rabi-snooze-api (npm)
- Jul 9, 2026
Malicious code in qlkube (npm)
1 compromised version
- Jul 9, 2026
Malicious code in poc-node-npm (npm)
- Jul 9, 2026
Malicious code in fusion-client (npm)
- Jul 9, 2026
Malicious code in feedback-api (npm)
- Jul 9, 2026
Malicious code in breeze-feature-flag-poc (npm)
- Jul 9, 2026
Malicious code in bizapi-portal (npm)
Page 11 of 5,116