Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,236 total · sorted newest first- May 21, 2026
Malicious code in webservices.rest (npm)
3 compromised versions
- May 21, 2026
Malicious code in webservices.rest-utils (npm)
3 compromised versions
- May 21, 2026
Malicious code in @tiledesk/tiledesk-server (npm)
6 compromised versions
- May 21, 2026
Malicious code in @toni77777/aora (npm)
2 compromised versions
- May 21, 2026
Malicious code in wdt-erpmcp (PyPI)
3 compromised versions
- May 21, 2026
Malicious code in turing-sdk (npm)
1 compromised version
- May 21, 2026
Malicious code in auth0-templates-scripts-utils (npm)
2 compromised versions
- May 21, 2026
Malicious code in auth0-templates-scripts (npm)
2 compromised versions
- May 21, 2026
Malicious code in sparkecoder (npm)
1 compromised version
- May 21, 2026
Malicious code in @zhengshuo888/huoke (npm)
2 compromised versions
- May 21, 2026
Malicious code in git-userhub (npm)
2 compromised versions
- May 21, 2026
Malicious code in @atlisp/mcp (npm)
1 compromised version
- May 21, 2026
Malicious code in claw_messenger (npm)
17 compromised versions
- May 21, 2026
Malicious code in dot-utils-plus (npm)
3 compromised versions
- May 21, 2026
Malicious code in @onerjs/smart-filters (npm)
2 compromised versions
- May 21, 2026
Malicious code in @zentrix23/baileys (npm)
1 compromised version
- May 21, 2026
Malicious code in fastgrc-openclaw (npm)
1 compromised version
- May 21, 2026
Malicious code in polygon-toolkit-validate (npm)
1 compromised version
- May 21, 2026
Malicious code in selfservsweeper (PyPI)
1 compromised version
- May 21, 2026
Malware in art-template
1 compromised version
- May 21, 2026
Malicious code in seedcode-facturacion-electronica (npm)
1 compromised version
- May 21, 2026
Malicious code in cerebrum-core (npm)
1 compromised version
- May 21, 2026
Malicious code in @djessicatony/folk-mcp-canary (npm)
1 compromised version
- May 21, 2026
Malicious code in @gad360/apothem (npm)
1 compromised version
- May 21, 2026
Malicious code in n8n-nodes-pentest-rce (npm)
26 compromised versions
- May 21, 2026
Malicious code in omnius (npm)
9 compromised versions
- May 21, 2026
Malicious code in @kruzer/lib-ui (npm)
2 compromised versions
- May 21, 2026
Malicious code in anthropic-shared-logger (npm)
1 compromised version
- May 21, 2026
Malicious code in wallet-security-checker (npm)
12 compromised versions
- May 21, 2026
Malicious code in polymarket-trading-cli (npm)
- May 21, 2026
Malicious code in polymarket-trader (npm)
- May 21, 2026
Malicious code in polymarket-trade (npm)
1 compromised version
- May 21, 2026
Malicious code in polymarket-terminal (npm)
- May 21, 2026
Malicious code in polymarket-copy-trading (npm)
1 compromised version
- May 21, 2026
Malicious code in polymarket-claude-code (npm)
1 compromised version
- May 21, 2026
Malicious code in polymarket-bot (npm)
- May 21, 2026
Malicious code in polymarket-auto-trade (npm)
- May 21, 2026
Malicious code in polymarket-ai-agent (npm)
- May 21, 2026
Malicious code in mnemonic-safety-check (npm)
15 compromised versions
- May 21, 2026
Malicious code in eth-wallet-sentinel (npm)
15 compromised versions
- May 21, 2026
Malicious code in defi-threat-scanner (npm)
14 compromised versions
- May 21, 2026
Malicious code in crypto-credential-scanner (npm)
14 compromised versions
- May 21, 2026
Malicious code in chain-key-validator (npm)
14 compromised versions
- May 20, 2026
Malicious code in claude-internal-utils (npm)
1 compromised version
- May 20, 2026
Malicious code in obs-migrate (PyPI)
1 compromised version
- May 20, 2026
Malicious code in deployment-key-auditor (npm)
15 compromised versions
- May 20, 2026
Malicious code in defi-env-auditor (npm)
14 compromised versions
- May 20, 2026
Malicious code in solidity-deploy-guard (npm)
13 compromised versions
- May 20, 2026
Malicious code in @cometix/claude-code (npm)
2 compromised versions
- May 20, 2026
Malicious code in @jemavidev/betteragents-pi (npm)
8 compromised versions
Page 150 of 5,125