Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,238 total · sorted newest first- May 20, 2026
Malicious code in bucket-protocol-sdk-v2 (npm)
7 compromised versions
- May 20, 2026
Malicious code in @pluxee-connect/api-client (npm)
2 compromised versions
- May 20, 2026
Malicious code in mcp-server-iehub-proxy (npm)
1 compromised version
- May 20, 2026
Malicious code in @tailwind-core/oxide-win32-x64-msvc (npm)
1 compromised version
- May 20, 2026
Malicious code in figma-d2c-utils (npm)
1 compromised version
- May 20, 2026
Malicious code in @thesignup/cli (npm)
1 compromised version
- May 20, 2026
Malicious code in @web-3d-tool/sdk (npm)
1 compromised version
- May 20, 2026
Malicious code in @serviceshub/x-web-core (npm)
1 compromised version
- May 20, 2026
Malicious code in ethers-wallet-packages (npm)
2 compromised versions
- May 20, 2026
Malicious code in python-utils (npm)
1 compromised version
- May 20, 2026
Malicious code in stripe-internal (PyPI)
1 compromised version
- May 20, 2026
Malicious code in cb-wallet-data (npm)
1 compromised version
- May 20, 2026
Malicious code in vestibulect (npm)
1 compromised version
- May 20, 2026
Malicious code in @trackking/core (npm)
1 compromised version
- May 20, 2026
Malicious code in @ikyyofc/gemini-cli (npm)
17 compromised versions
- May 20, 2026
Malicious code in @vtmn-play/react (npm)
1 compromised version
- May 20, 2026
Malicious code in @wengine-ai/claude-code-router-shared (npm)
7 compromised versions
- May 20, 2026
Malicious code in wallet-agent-ai-radix (npm)
1 compromised version
- May 20, 2026
Malicious code in color-style-utils (npm)
7 compromised versions
- May 20, 2026
Malicious code in stripe-commands (PyPI)
1 compromised version
- May 20, 2026
Malicious code in @flipbit2-bb/test-auth-state (npm)
1 compromised version
- May 20, 2026
Malicious code in @deadcode09284814/axios-util (npm)
2 compromised versions
- May 20, 2026
Malicious code in chalk-tempalte (npm)
6 compromised versions
- May 20, 2026
Malicious code in cloud-pc-templates (npm)
1 compromised version
- May 20, 2026
Malicious code in ezymail (npm)
6 compromised versions
- May 20, 2026
Malicious code in @venturo/playwright (npm)
1 compromised version
- May 20, 2026
Malicious code in pulse-axios (npm)
3 compromised versions
- May 20, 2026
Malicious code in foundy-toolkit (npm)
1 compromised version
- May 20, 2026
Malicious code in rdflib (npm)
1 compromised version
- May 20, 2026
Malicious code in stripe-utils (PyPI)
8 compromised versions
- May 20, 2026
Malicious code in axois-utils (npm)
6 compromised versions
- May 20, 2026
Malicious code in carvus-lens (npm)
1 compromised version
- May 20, 2026
Malicious code in polymarket-clob-client (npm)
1 compromised version
- May 20, 2026
Malicious code in @shinzepelly/libsignal-node (npm)
1 compromised version
- May 20, 2026
Malicious code in @tailwind-core/webpack (npm)
1 compromised version
- May 20, 2026
Malicious code in @solarcraft/observix (npm)
1 compromised version
- May 20, 2026
Malicious code in get-deps-path (npm)
6 compromised versions
- May 20, 2026
Malicious code in fca-eryxenx (npm)
1 compromised version
- May 20, 2026
Malicious code in truffle-config-helper (npm)
1 compromised version
- May 20, 2026
Malicious code in customerdigital-ui-containers-lib (npm)
3 compromised versions
- May 20, 2026
Malicious code in code-tool-langfuse (npm)
5 compromised versions
- May 20, 2026
Malicious code in hpsetup (npm)
11 compromised versions
- May 20, 2026
Malicious code in etherjs-utils (npm)
1 compromised version
- May 20, 2026
Malicious code in jsonbson (npm)
5 compromised versions
- May 20, 2026
Malicious code in @mcpassure/mcp-cnes (npm)
11 compromised versions
- May 20, 2026
Malicious code in @mcpassure/mcp-anvisa-bulario (npm)
10 compromised versions
- May 20, 2026
Malicious code in hardhat-gas-profiler-plugin (npm)
1 compromised version
- May 20, 2026
Malicious code in chainlink-price-feed-aggregator (npm)
1 compromised version
- May 20, 2026
Malicious code in @rocketreach/rr-components (npm)
1 compromised version
- May 20, 2026
Malicious code in @tailwind-core/postcss (npm)
1 compromised version
Page 153 of 5,125