Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,077 total · sorted newest first- Jun 9, 2026
Malicious code in @klapp-kyc/routes (npm)
2 compromised versions
- Jun 9, 2026
Malicious code in @payment-review/store (npm)
2 compromised versions
- Jun 9, 2026
Malicious code in @card-pci-data/store (npm)
2 compromised versions
- Jun 9, 2026
Malicious code in @klapp-sca/routes (npm)
2 compromised versions
- Jun 9, 2026
Malicious code in @klapp-about/routes (npm)
3 compromised versions
- Jun 9, 2026
Malicious code in @klapp-login-platform/oidc (npm)
2 compromised versions
- Jun 9, 2026
Malicious code in @klapp-login-platform/native-sdk (npm)
2 compromised versions
- Jun 9, 2026
Malicious code in @klapp-login-platform/routes (npm)
2 compromised versions
- Jun 9, 2026
Malicious code in morningstar-design-system (npm)
3 compromised versions
- Jun 9, 2026
Malicious code in o3forms (npm)
2 compromised versions
- Jun 9, 2026
Malicious code in via-city-tools-m-particle (npm)
1 compromised version
- Jun 9, 2026
Malicious code in ui-ng-components (npm)
1 compromised version
- Jun 9, 2026
Malicious code in uipath-sugar-sell (npm)
1 compromised version
- Jun 9, 2026
Malicious code in tivo-codelib-a (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @webda-features/dashboard (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @webd-infra/query-designer-domain (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @webda-infra/search (npm)
1 compromised version
- Jun 9, 2026
Malicious code in privacy-sdk (npm)
1 compromised version
- Jun 9, 2026
Malicious code in commons-ui-styles (npm)
1 compromised version
- Jun 9, 2026
Malicious code in corporate-front-vue (npm)
1 compromised version
- Jun 9, 2026
Malicious code in mazemap (npm)
1 compromised version
- Jun 9, 2026
Malicious code in localization-lib (npm)
1 compromised version
- Jun 9, 2026
Malicious code in housecall-ui (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @shell-landing/routes (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @easy-entry/outside-registration-fop-navigator (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @shell-cabinet/routes (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @easy-entry/routes (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @easy-entry/landing-routes (npm)
1 compromised version
- Jun 9, 2026
Malicious code in shopify-app-bridge-internal (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @sourceflow-uk/sourceflow-tracker (npm)
1 compromised version
- Jun 9, 2026
Malicious code in ac_calendar_ts (npm)
1 compromised version
- Jun 9, 2026
Malicious code in ac_semantic-ui_ts (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @oplus/obus-web-sdk (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @oplus/obus-web-sdk-plugin-recovery (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @oplus/obus-core (npm)
1 compromised version
- Jun 9, 2026
Malicious code in tao-subnet-metrics (PyPI)
1 compromised version
- Jun 9, 2026
Malicious code in ultimate-ai-power (PyPI)
1 compromised version
- Jun 9, 2026
Malicious code in comos-sdk (npm)
1 compromised version
- Jun 9, 2026
Malware in comos-sdk
1 compromised version
- Jun 9, 2026
Malicious code in cubifyanything (PyPI)
3 compromised versions
- Jun 9, 2026
Malicious code in @0xlr/sentry-web (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @0xlr/clerk-auth (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @0xlr/prisma-client-js (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @0xlr/vercel-analytics (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @0xlr/stripe-frontend (npm)
1 compromised version
- Jun 9, 2026
Malicious code in @0xlr/stripe-checkout-js (npm)
1 compromised version
- Jun 9, 2026
Malicious code in ui-weave (npm)
1 compromised version
- Jun 9, 2026
Malware in ui-weave
1 compromised version
- Jun 9, 2026
Malicious code in @0xlr/supabase-db (npm)
1 compromised version
- Jun 9, 2026
Malicious code in kraken-ui (npm)
1 compromised version
Page 117 of 5,122