Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,077 total · sorted newest first- Jun 11, 2026
Malicious code in express-self-destruct2 (npm)
1 compromised version
- Jun 11, 2026
Malicious code in express-self-destruct (npm)
1 compromised version
- Jun 11, 2026
Malicious code in india-map-react (npm)
3 compromised versions
- Jun 11, 2026
Malicious code in @w2d/web-components (npm)
1 compromised version
- Jun 11, 2026
Malicious code in jailbreak-code (npm)
2 compromised versions
- Jun 11, 2026
Malicious code in acme-widget-layout-utils (PyPI)
3 compromised versions
- Jun 11, 2026
Malicious code in pocteszep (npm)
7 compromised versions
- Jun 11, 2026
Malicious code in @monitoring-lib/error-tracking (npm)
1 compromised version
- Jun 11, 2026
Malicious code in mermaid-v11 (npm)
3 compromised versions
- Jun 11, 2026
Malicious code in @common-stack/generate-plugin (npm)
15 compromised versions
- Jun 11, 2026
Malware in @common-stack/generate-plugin
1 compromised version
- Jun 11, 2026
Malicious code in @entos-ems/xerxes-client-js (npm)
1 compromised version
- Jun 11, 2026
Malicious code in hex-type (npm)
1 compromised version
- Jun 10, 2026
Malicious code in zer0onedate (npm)
2 compromised versions
- Jun 10, 2026
Malicious code in zer0onedatetool (npm)
1 compromised version
- Jun 10, 2026
Malicious code in @thomlecter1122/lab-helper-test (npm)
6 compromised versions
- Jun 10, 2026
Malicious code in @coze-common/chat-area (npm)
1 compromised version
- Jun 10, 2026
Malicious code in icinga (PyPI)
2 compromised versions
- Jun 10, 2026
Malicious code in telegramlite (PyPI)
2 compromised versions
- Jun 10, 2026
Malicious code in chai-check-error (npm)
5 compromised versions
- Jun 10, 2026
Malicious code in check-error-util (npm)
6 compromised versions
- Jun 10, 2026
Malicious code in websocket-slot (npm)
1 compromised version
- Jun 10, 2026
Malicious code in @solana-labs/web3.js (npm)
6 compromised versions
- Jun 10, 2026
Malicious code in v018-axios-cdntest (npm)
4 compromised versions
- Jun 10, 2026
Malicious code in @access-risk/browser-remedy-react (npm)
2 compromised versions
- Jun 10, 2026
Malicious code in @helpcentre/tesco-help (npm)
1 compromised version
- Jun 10, 2026
Malicious code in @orion-design-system/foundation (npm)
5 compromised versions
- Jun 10, 2026
Malicious code in @orion-design-system/components (npm)
4 compromised versions
- Jun 10, 2026
Malicious code in @orion-design-system/store (npm)
3 compromised versions
- Jun 10, 2026
Malicious code in events-runtime (npm)
6 compromised versions
- Jun 10, 2026
Malicious code in firefly-utilities-helper (npm)
2 compromised versions
- Jun 10, 2026
Malicious code in hello-dynamic (PyPI)
3 compromised versions
- Jun 10, 2026
Malicious code in requests-toolbelt-plus (PyPI)
4 compromised versions
- Jun 10, 2026
Malicious code in yelp-react-component-chaos (npm)
1 compromised version
- Jun 10, 2026
Malicious code in tailwind-animator (npm)
- Jun 10, 2026
Malware in tailwind-animator
1 compromised version
- Jun 10, 2026
Malicious code in crypto-promise-js (npm)
- Jun 10, 2026
Malware in crypto-promise-js
1 compromised version
- Jun 10, 2026
Malware in prettier-sdk
1 compromised version
- Jun 10, 2026
Malware in crypto-hash-sdk
1 compromised version
- Jun 10, 2026
Malware in devkitx
1 compromised version
- Jun 10, 2026
Malicious code in anaylze-json (npm)
1 compromised version
- Jun 10, 2026
Malware in anaylze-json
1 compromised version
- Jun 10, 2026
Malware in security-env-loader
1 compromised version
- Jun 10, 2026
Malicious code in nw-demo-utils (npm)
19 compromised versions
- Jun 10, 2026
Malware in nw-demo-utils
1 compromised version
- Jun 10, 2026
Malware in nw-demo
1 compromised version
- Jun 10, 2026
Malware in auth0-templates-scripts-utils
1 compromised version
- Jun 10, 2026
Malware in auth0-templates-scripts
1 compromised version
- Jun 10, 2026
Malware in @easytipsportal/node-helper
1 compromised version
Page 114 of 5,122