Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,236 total · sorted newest first- May 20, 2026
Malicious code in @scp3500/openvl (npm)
1 compromised version
- May 20, 2026
Malicious code in @limebike/supreme (npm)
2 compromised versions
- May 20, 2026
Malicious code in web3-secrets-detector (npm)
15 compromised versions
- May 20, 2026
Malicious code in wallet-backup-verifier (npm)
10 compromised versions
- May 20, 2026
Malicious code in encrata-cli (npm)
2 compromised versions
- May 20, 2026
Malicious code in naileys (npm)
1 compromised version
- May 20, 2026
Malicious code in @rspack-debug/core (npm)
1 compromised version
- May 20, 2026
Malicious code in libhmac (PyPI)
4 compromised versions
- May 20, 2026
Malicious code in tango-app-api-trax (npm)
7 compromised versions
- May 20, 2026
Malicious code in bitrix24-tasks-mcp-server (npm)
5 compromised versions
- May 20, 2026
Malicious code in @spcsn/taro-cli (npm)
1 compromised version
- May 20, 2026
Malicious code in yessir-node (npm)
1 compromised version
- May 20, 2026
Malicious code in klaudius (npm)
6 compromised versions
- May 20, 2026
Malicious code in svharness (npm)
1 compromised version
- May 20, 2026
Malicious code in gm-kilo (npm)
1 compromised version
- May 20, 2026
Malicious code in nw-demo (npm)
1 compromised version
- May 20, 2026
Malicious code in nolimit-x (npm)
41 compromised versions
- May 20, 2026
Malicious code in prjct-cli (npm)
1 compromised version
- May 20, 2026
Malicious code in pinno-loggers (npm)
1 compromised version
- May 20, 2026
Malicious code in @semacode/cli (npm)
1 compromised version
- May 20, 2026
Malicious code in pretty-logger-utils (npm)
1 compromised version
- May 20, 2026
Malicious code in bricks-builder-mcp (npm)
4 compromised versions
- May 20, 2026
Malicious code in local-mcp (npm)
22 compromised versions
- May 20, 2026
Malicious code in art-template (npm)
4 compromised versions
- May 20, 2026
Malicious code in use-context-selector-tony (npm)
1 compromised version
- May 20, 2026
Malicious code in pino-formatter (npm)
2 compromised versions
- May 20, 2026
Malicious code in idlidosa (npm)
5 compromised versions
- May 20, 2026
Malicious code in tdpilot (npm)
2 compromised versions
- May 20, 2026
Malicious code in @weirdorg/config (npm)
1 compromised version
- May 20, 2026
Malicious code in arc-diag-util (npm)
1 compromised version
- May 20, 2026
Malicious code in @zesyn/zeditor (npm)
1 compromised version
- May 20, 2026
Malicious code in @weirdorg/dotenv (npm)
1 compromised version
- May 20, 2026
Malicious code in seekcode (npm)
3 compromised versions
- May 20, 2026
Malicious code in @qwedqwed/axios (npm)
3 compromised versions
- May 20, 2026
Malicious code in ts-logger-pack (npm)
6 compromised versions
- May 20, 2026
Malicious code in terminal-logger-utils (npm)
3 compromised versions
- May 20, 2026
Malicious code in @sec-loans-ui/utils (npm)
1 compromised version
- May 20, 2026
Malicious code in @riskine-frontend/design-elements (npm)
1 compromised version
- May 20, 2026
Malicious code in openclaw-agent (PyPI)
1 compromised version
- May 20, 2026
Malicious code in react-tracked-tony (npm)
1 compromised version
- May 20, 2026
Malicious code in qazaq-cli (npm)
1 compromised version
- May 20, 2026
Malicious code in promptbook-cli (npm)
1 compromised version
- May 20, 2026
Malicious code in promptbook-mcp (npm)
1 compromised version
- May 20, 2026
Malicious code in fca-official-uzair-rajput (npm)
1 compromised version
- May 20, 2026
Malicious code in security-env-loader (npm)
1 compromised version
- May 20, 2026
Malicious code in @touchvue/chat (npm)
3 compromised versions
- May 20, 2026
Malicious code in fulcrum-sessions (npm)
2 compromised versions
- May 20, 2026
Malicious code in axiosqqq (npm)
4 compromised versions
- May 20, 2026
Malicious code in bucket-protocol-sdk-v2 (npm)
7 compromised versions
- May 20, 2026
Malicious code in @pluxee-connect/api-client (npm)
2 compromised versions
Page 152 of 5,125