Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,077 total · sorted newest first- May 29, 2026
Malware in private-next-instrumentation-client
1 compromised version
- May 29, 2026
Malware in mmt-static
1 compromised version
- May 29, 2026
Malware in tailwind-clamps-line
1 compromised version
- May 29, 2026
Malicious code in gcp-api-enabler (npm)
1 compromised version
- May 29, 2026
Malicious code in ethers-errors (npm)
- May 29, 2026
Malware in erslove
1 compromised version
- May 29, 2026
Malware in gcp-api-enabler
1 compromised version
- May 29, 2026
Malware in material-ui-plugin-cache-endpoint
1 compromised version
- May 29, 2026
Malware in nextjs-chat-with-ai-service
1 compromised version
- May 29, 2026
Malware in ethers-errors
1 compromised version
- May 29, 2026
Malicious code in @timelycare/core (npm)
- May 29, 2026
Malicious code in @timelycare/api (npm)
- May 29, 2026
Malicious code in @tc-core/provider-service (npm)
- May 29, 2026
Malicious code in @rsi-community/hub-client-app (npm)
1 compromised version
- May 29, 2026
Malware in @tc-core/provider-service
1 compromised version
- May 29, 2026
Malware in @lint-md/core
1 compromised version
- May 29, 2026
Malware in @clearpool/streaming
1 compromised version
- May 29, 2026
Malware in @timelycare/api
1 compromised version
- May 29, 2026
Malware in @tallyui/storage-sqlite
1 compromised version
- May 29, 2026
Malware in @rsi-community/hub-client-app
1 compromised version
- May 29, 2026
Malware in @timelycare/core
1 compromised version
- May 29, 2026
Malicious code in foundry-config (npm)
- May 29, 2026
Malware in deepl-sync
1 compromised version
- May 29, 2026
Malware in dit-envv
1 compromised version
- May 29, 2026
Malware in foundry-config
1 compromised version
- May 29, 2026
Malicious code in codex-devcontainer-install (npm)
- May 29, 2026
Malicious code in @cplace-project-planning-fe/cf-project-planning (npm)
- May 29, 2026
Malware in @antv/x6-plugin-stencil
1 compromised version
- May 29, 2026
Malware in @antv/x6-common
1 compromised version
- May 29, 2026
Malware in @antv/x6-plugin-dnd
1 compromised version
- May 29, 2026
Malware in @antv/xflow
1 compromised version
- May 29, 2026
Malware in @antv/translator
1 compromised version
- May 29, 2026
Malware in @antv/util
1 compromised version
- May 29, 2026
Malware in codex-devcontainer-install
1 compromised version
- May 29, 2026
Malware in @clearpool/comms
1 compromised version
- May 29, 2026
Malware in dds-js-idl-types
1 compromised version
- May 29, 2026
Malware in @antv/torch
1 compromised version
- May 29, 2026
Malware in @antv/x6-plugin-history
1 compromised version
- May 29, 2026
Malware in @cplace-project-planning-fe/cf-project-planning
1 compromised version
- May 29, 2026
Malware in @antv/vis-predict-engine
1 compromised version
- May 29, 2026
Malicious code in ethers-hash (npm)
- May 29, 2026
Malware in ethers-hash
1 compromised version
- May 29, 2026
Malware in ast-plugin
1 compromised version
- May 29, 2026
Malware in ally-eagw-identity
1 compromised version
- May 29, 2026
Malware in axis-notification
1 compromised version
- May 29, 2026
Malware in ally-ccapi
1 compromised version
- May 29, 2026
Malicious code in @timelycare/common (npm)
- May 29, 2026
Malicious code in @lir-portal/web-components (npm)
- May 29, 2026
Malware in @lir-portal/web-components
1 compromised version
- May 29, 2026
Malware in @timelycare/common
1 compromised version
Page 129 of 5,122