Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,683 total · sorted newest first- Oct 20, 2026
Malicious code in tailwindcss-animate-catalog (npm)
1 compromised version
- Oct 20, 2026
Malicious code in ccl-global-shopping (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwindcss-effect-lab (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-animationlab (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-luminary (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animate-twcss-bridge (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-css-keyframes (npm)
1 compromised version
- Oct 20, 2026
Malicious code in signalledger-diagnostics (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-animatecss-kit (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animate-tailwind-kit (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-animate-kit (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-graphic (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animate-twcss-pack (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-vectrix (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-kinetic (npm)
1 compromised version
- Oct 20, 2026
Malicious code in signalledger-bridge (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-plugin (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-presets (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-helper (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-binary (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-animaflow-kit (npm)
1 compromised version
- Oct 20, 2026
Malicious code in sc-announcer (npm)
1 compromised version
- Oct 20, 2026
Malicious code in fanarena-common (npm)
1 compromised version
- Oct 20, 2026
Malicious code in ccl-global-shopping (npm)
1 compromised version
- Oct 20, 2026
Malicious code in sc-wizard (npm)
1 compromised version
- Oct 20, 2026
Malicious code in asurion (PyPI)
1 compromised version
- Oct 19, 2026
Malicious code in @an1mshnpmb9c84920/stage-repo-m19g7 (npm)
- Oct 19, 2026
Malicious code in @an1mshnpmb9c84920/stage-outer-m19s5 (npm)
- Oct 19, 2026
Malicious code in @an1mshnpmb9c84920/stage-fn-m19p2 (npm)
- Oct 19, 2026
Malicious code in @an1mshnpmb9c84920/pipe-dns-m19t2 (npm)
1 compromised version
- Oct 19, 2026
Malicious code in @an1mshnpmb9c84920/gat-scope-target-125ec19a (npm)
- Oct 19, 2026
Malware in @an1mshnpmb9c84920/stage-fn-m19p2
1 compromised version
- Oct 19, 2026
Malware in @an1mshnpmb9c84920/gat-scope-target-125ec19a
1 compromised version
- Oct 19, 2026
Malware in @an1mshnpmb9c84920/stage-outer-m19s5
1 compromised version
- Oct 19, 2026
Malware in @an1mshnpmb9c84920/stage-repo-m19g7
1 compromised version
- Oct 19, 2026
Malware in @an1mshnpmb9c84920/pipe-dns-m19t2
1 compromised version
- Oct 19, 2026
Malicious code in @an1mshnpmb9c84920/pipe-compat-m19r8 (npm)
- Oct 19, 2026
Malicious code in @an1mshnpmb9c84920/oidc-cross-cafb9d929e (npm)
- Oct 19, 2026
Malware in @an1mshnpmb9c84920/oidc-cross-cafb9d929e
1 compromised version
- Oct 19, 2026
Malware in @an1mshnpmb9c84920/pipe-compat-m19r8
1 compromised version
- Oct 19, 2026
Malicious code in codex-setup (npm)
- Oct 19, 2026
Malicious code in claude-desktop-setup (npm)
- Oct 19, 2026
Malicious code in chatgpt-pro-setup-tool (npm)
- Oct 19, 2026
Malicious code in chatgpt-pro-activator (npm)
- Oct 19, 2026
Malicious code in chatgpt-desktop-setup (npm)
- Oct 19, 2026
Malicious code in api-anthropic (npm)
- Oct 19, 2026
Malicious code in @decoopus/claude-setup (npm)
3 compromised versions
- Oct 19, 2026
Malicious code in @decoopus/chatgpt-setup (npm)
- Oct 19, 2026
Malware in chatgpt-pro-setup-tool
1 compromised version
- Oct 19, 2026
Malware in chatgpt-pro-activator
1 compromised version
Page 13 of 7,294