Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,077 total · sorted newest first- May 29, 2026
Malware in @t-in-one/get_application_hid
1 compromised version
- May 29, 2026
Malware in @t-in-one/prefill_transformers_data_token
1 compromised version
- May 29, 2026
Malware in @sber-ecom-core/sberpay-widget
1 compromised version
- May 29, 2026
Malware in @t-in-one/prefill_credit_data_token
1 compromised version
- May 29, 2026
Malware in @t-in-one/send_add_application
1 compromised version
- May 29, 2026
Malware in @t-in-one/add_application_tid
1 compromised version
- May 29, 2026
Malware in @t-in-one/form_product_token
1 compromised version
- May 29, 2026
Malware in @t-in-one/add_application_service_token
1 compromised version
- May 29, 2026
Malware in @t-in-one/application_id_storage_key_token
1 compromised version
- May 29, 2026
Malware in @t-in-one/save_application_hid_to_storage
1 compromised version
- May 29, 2026
Malware in @t-in-one/add_app_middleware_token
1 compromised version
- May 29, 2026
Malware in @t-in-one/add_application
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/security-groups
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/vpn
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/floating-ips
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/ml-ai-agents-agent-system
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/datagrid
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/marketplace-gigachat
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/svp-baas
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/cloud-dns
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/monitoring
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/dataplatform-metastore
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/employees
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/dataplatform-trino
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/enterprise
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/ssh-keys
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/support
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/cnapp-ui
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/svp-interfaces
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/cp-api-gw
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/dataplatform
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/ml-ai-agents-agent
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/svp-s3-storage
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/base-static-page
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/logaas
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/arenadata-db
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/administration
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/business-solutions
1 compromised version
- May 29, 2026
Malware in power-platform-playwright-toolkit
1 compromised version
- May 29, 2026
Malicious code in puppeteer (npm)
1 compromised version
- May 29, 2026
Withdrawn Advisory: Malware in puppeteer
1 compromised version
- May 29, 2026
Malicious code in midoss (npm)
- May 29, 2026
Malware in midoss
1 compromised version
- May 29, 2026
Malicious code in customerdigital-service-lib (npm)
- May 29, 2026
Malware in relationship.js
1 compromised version
- May 29, 2026
Malware in customerdigital-service-lib
1 compromised version
- May 29, 2026
Malicious code in hardhat-evmchain (npm)
- May 29, 2026
Malicious code in chai-bundle (npm)
1 compromised version
- May 29, 2026
Malware in chai-bundle
1 compromised version
- May 29, 2026
Malware in hardhat-evmchain
1 compromised version
Page 126 of 5,122