Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,077 total · sorted newest first- Jun 5, 2026
Malicious code in autotel-web (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-vitest (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-tanstack (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-subscribers (npm)
28 compromised versions
- Jun 5, 2026
Malicious code in autotel-sentry (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-plugins (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-playwright (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-pact (npm)
2 compromised versions
- Jun 5, 2026
Malicious code in autotel-mongoose (npm)
7 compromised versions
- Jun 5, 2026
Malicious code in autotel-mcp-instrumentation (npm)
6 compromised versions
- Jun 5, 2026
Malicious code in autotel-mcp (npm)
28 compromised versions
- Jun 5, 2026
Malicious code in autotel-hono (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-eventcatalog (npm)
5 compromised versions
- Jun 5, 2026
Malicious code in autotel-edge (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-drizzle (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-devtools (npm)
8 compromised versions
- Jun 5, 2026
Malicious code in autotel-cloudflare (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-cli (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-backends (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-aws (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-audit (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel-adapters (npm)
1 compromised version
- Jun 5, 2026
Malicious code in autotel (npm)
2 compromised versions
- Jun 5, 2026
Malicious code in ai-sdk-ollama (npm)
4 compromised versions
- Jun 5, 2026
Malicious code in @vapi-ai/server-sdk (npm)
4 compromised versions
- Jun 5, 2026
Malicious code in @forjacms/sections-react (npm)
2 compromised versions
- Jun 5, 2026
Malicious code in @forjacms/sections (npm)
2 compromised versions
- Jun 5, 2026
Malicious code in @forjacms/client (npm)
2 compromised versions
- Jun 5, 2026
Malicious code in @forjacms/analytics (npm)
2 compromised versions
- Jun 5, 2026
Malicious code in @ethlete/types (npm)
1 compromised version
- Jun 5, 2026
Malicious code in @ethlete/theming (npm)
1 compromised version
- Jun 5, 2026
Malicious code in @ethlete/query (npm)
1 compromised version
- Jun 5, 2026
Malicious code in @ethlete/dsp (npm)
1 compromised version
- Jun 5, 2026
Malicious code in @ethlete/core (npm)
1 compromised version
- Jun 5, 2026
Malicious code in @ethlete/contentful (npm)
1 compromised version
- Jun 5, 2026
Malicious code in @ethlete/components (npm)
1 compromised version
- Jun 5, 2026
Malicious code in @ethlete/cli (npm)
1 compromised version
- Jun 5, 2026
Malicious code in @ethlete/cdk (npm)
1 compromised version
- Jun 5, 2026
Malicious code in @contaazul/n8n-nodes-contaazul (npm)
1 compromised version
- Jun 4, 2026
Malicious code in yaml-javascript (npm)
1 compromised version
- Jun 4, 2026
Malicious code in javascript-yaml (npm)
1 compromised version
- Jun 4, 2026
Malicious code in weavedb-contracts (npm)
1 compromised version
- Jun 4, 2026
Malicious code in wdb-core (npm)
1 compromised version
- Jun 4, 2026
Malicious code in hbsig (npm)
2 compromised versions
- Jun 4, 2026
Malicious code in arjson (npm)
1 compromised version
- Jun 4, 2026
Malicious code in hello244a (npm)
46 compromised versions
- Jun 4, 2026
Malicious code in supabase (npm)
- Jun 4, 2026
Withdrawn Advisory: Malware in supabase
1 compromised version
- Jun 4, 2026
Malicious code in autotel-terminal (npm)
39 compromised versions
- Jun 4, 2026
Malware in autotel-terminal
1 compromised version
Page 122 of 5,122