Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,077 total · sorted newest first- Jun 12, 2026
Malware in sea-bound-siren
1 compromised version
- Jun 12, 2026
Malware in ecto-rust-read-f3a9c1
1 compromised version
- Jun 12, 2026
Malware in @malwguy/ecto-corsair-whisper-3d2a7c
1 compromised version
- Jun 12, 2026
Malware in ecto-corsair-whisper-6f3b9
1 compromised version
- Jun 12, 2026
Malware in ecto-win-flag-q2m7
1 compromised version
- Jun 12, 2026
Malicious code in jec (PyPI)
1 compromised version
- Jun 12, 2026
Malicious code in trongapy (PyPI)
1 compromised version
- Jun 12, 2026
Malicious code in coral-wraith (npm)
47 compromised versions
- Jun 11, 2026
Malicious code in trongap (PyPI)
1 compromised version
- Jun 11, 2026
Malicious code in bittensor-burn-message (PyPI)
1 compromised version
- Jun 11, 2026
Malicious code in internallib_v557 (npm)
24 compromised versions
- Jun 11, 2026
Malicious code in pylogxo (PyPI)
2 compromised versions
- Jun 11, 2026
Malicious code in worker-build (npm)
3 compromised versions
- Jun 11, 2026
Malicious code in @johntaohunter/forge-jsx (npm)
- Jun 11, 2026
Malware in @johntaohunter/forge-jsx
1 compromised version
- Jun 11, 2026
Malicious code in ioredis-typed (npm)
1 compromised version
- Jun 11, 2026
Malicious code in ioredis-orm (npm)
1 compromised version
- Jun 11, 2026
Malware in ioredis-orm
1 compromised version
- Jun 11, 2026
Malware in ioredis-typed
1 compromised version
- Jun 11, 2026
Malware in forge-jsx2
1 compromised version
- Jun 11, 2026
Malware in forge-jsxy
1 compromised version
- Jun 11, 2026
Malicious code in vqlxjmpr (npm)
5 compromised versions
- Jun 11, 2026
Malware in vqlxjmpr
1 compromised version
- Jun 11, 2026
Malicious code in zatzdbai (npm)
- Jun 11, 2026
Malicious code in downlynpm (npm)
3 compromised versions
- Jun 11, 2026
Malware in downlynpm
1 compromised version
- Jun 11, 2026
Malware in zatzdbai
1 compromised version
- Jun 11, 2026
Malware in hex-type
1 compromised version
- Jun 11, 2026
Malicious code in @visma-net-platform/module-navigator (npm)
1 compromised version
- Jun 11, 2026
Malicious code in @tribe-digital/shopify-starter-theme (npm)
1 compromised version
- Jun 11, 2026
Malicious code in @tenforce/toolbox-fontmap (npm)
1 compromised version
- Jun 11, 2026
Malicious code in @snowsight/debug-tooling (npm)
1 compromised version
- Jun 11, 2026
Malicious code in @sazka/web (npm)
- Jun 11, 2026
Malicious code in @ntnx/nx-react-components (npm)
- Jun 11, 2026
Malicious code in @ngt-frontend/widgets-core (npm)
- Jun 11, 2026
Malicious code in @marketplace-shared/components (npm)
1 compromised version
- Jun 11, 2026
Malicious code in @iobeya/spa-auth (npm)
- Jun 11, 2026
Malicious code in @integrations-center/utils (npm)
- Jun 11, 2026
Malicious code in @hatcha-captcha/core (npm)
1 compromised version
- Jun 11, 2026
Malicious code in @coterie-baby/common (npm)
- Jun 11, 2026
Malware in @serviceshub/x-web-core
1 compromised version
- Jun 11, 2026
Malware in @ngt-frontend/widgets-core
1 compromised version
- Jun 11, 2026
Malware in @integrations-center/utils
1 compromised version
- Jun 11, 2026
Malware in @coterie-baby/common
1 compromised version
- Jun 11, 2026
Malware in @vtmn-play/react
1 compromised version
- Jun 11, 2026
Malware in @ntnx/nx-react-components
1 compromised version
- Jun 11, 2026
Malware in @visma-net-platform/module-navigator
1 compromised version
- Jun 11, 2026
Malware in @web-3d-tool/sdk
1 compromised version
- Jun 11, 2026
Malware in @iobeya/spa-auth
1 compromised version
- Jun 11, 2026
Malware in @vivaux/telemetry
1 compromised version
Page 110 of 5,122