Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,238 total · sorted newest first- May 20, 2026
Malicious code in crypto-javascript (npm)
5 compromised versions
- May 20, 2026
Malicious code in ganache-cli-provider (npm)
1 compromised version
- May 20, 2026
Malicious code in solna-web3 (npm)
1 compromised version
- May 20, 2026
Malicious code in solana-pda-helper (npm)
1 compromised version
- May 20, 2026
Malicious code in foundry-deploy-helper (npm)
1 compromised version
- May 20, 2026
Malicious code in ethers-multicall-utils (npm)
1 compromised version
- May 19, 2026
Malicious code in @tailwind-core/vite (npm)
1 compromised version
- May 19, 2026
Malicious code in lokal-mcp (npm)
1 compromised version
- May 19, 2026
Malicious code in tubebrain (npm)
1 compromised version
- May 19, 2026
Malicious code in to-cms (npm)
2 compromised versions
- May 19, 2026
Malicious code in @flowselections/core (npm)
2 compromised versions
- May 19, 2026
Malicious code in @riteshkumar04/stack-audit (npm)
3 compromised versions
- May 19, 2026
Malicious code in martinez-polygon-clipping-tony (npm)
1 compromised version
- May 19, 2026
Malicious code in morin (PyPI)
3 compromised versions
- May 19, 2026
Malicious code in aurapro-ui (PyPI)
2 compromised versions
- May 19, 2026
Malicious code in did-0091 (npm)
5 compromised versions
- May 19, 2026
Malicious code in aurafarmer (PyPI)
1 compromised version
- May 19, 2026
Malicious code in silly-logger (PyPI)
3 compromised versions
- May 19, 2026
Malicious code in openirf (PyPI)
1 compromised version
- May 19, 2026
Malicious code in eplang (PyPI)
4 compromised versions
- May 19, 2026
Malicious code in pycalendar-api (PyPI)
1 compromised version
- May 19, 2026
Malicious code in glass-of-water (PyPI)
2 compromised versions
- May 19, 2026
Malicious code in nebulix-ai (PyPI)
2 compromised versions
- May 19, 2026
Malicious code in saas-common-lib-473815 (PyPI)
5 compromised versions
- May 19, 2026
Malicious code in clearml-truen-patch (PyPI)
1 compromised version
- May 19, 2026
Malicious code in zod-to-js (npm)
2 compromised versions
- May 19, 2026
Malicious code in soundsource (PyPI)
1 compromised version
- May 19, 2026
Malicious code in buddyme (PyPI)
2 compromised versions
- May 19, 2026
Malicious code in qontract-reconcile (PyPI)
4 compromised versions
- May 19, 2026
Malicious code in crw (PyPI)
3 compromised versions
- May 19, 2026
Malicious code in venturo-playwright-runner (npm)
4 compromised versions
- May 19, 2026
Malicious code in collected-forms-embed-js (npm)
4 compromised versions
- May 19, 2026
Malicious code in venturo-playwright (npm)
1 compromised version
- May 19, 2026
Malicious code in @arbocollab/arbo-web-people (npm)
6 compromised versions
- May 19, 2026
Malicious code in @dknzo/soonex-ai (npm)
2 compromised versions
- May 19, 2026
Malicious code in @tarojs/cli (npm)
2 compromised versions
- May 19, 2026
Malicious code in clsx-js (npm)
3 compromised versions
- May 19, 2026
Malicious code in workrally (npm)
1 compromised version
- May 19, 2026
Malicious code in dabrius-utils (PyPI)
2 compromised versions
- May 19, 2026
Malicious code in btd-smart (npm)
2 compromised versions
- May 19, 2026
Malicious code in crypto-hash-sdk (npm)
1 compromised version
- May 19, 2026
Malicious code in xorma-js (npm)
1 compromised version
- May 19, 2026
Malicious code in qr-code-styling-temp (npm)
2 compromised versions
- May 19, 2026
Malicious code in alya-baileys (npm)
8 compromised versions
- May 19, 2026
Malicious code in whiteboard-agent (npm)
2 compromised versions
- May 19, 2026
Malicious code in claude-all-config (npm)
3 compromised versions
- May 19, 2026
Malicious code in @shadanai/openclaw (npm)
3 compromised versions
- May 19, 2026
Malicious code in @bonsai-ai/claude-code (npm)
2 compromised versions
- May 19, 2026
Malicious code in corelia (npm)
1 compromised version
- May 19, 2026
Malicious code in @bonsai-ai/claude-code-win32-x64 (npm)
1 compromised version
Page 154 of 5,125