Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,886 total · sorted newest first- Jul 7, 2026
Malicious code in nuxt-fonts-devtools (npm)
1 compromised version
- Jul 7, 2026
Malicious code in load-nuxt-dev (npm)
1 compromised version
- Jul 7, 2026
Malicious code in load-nuxt (npm)
1 compromised version
- Jul 7, 2026
Malicious code in some-theme (npm)
1 compromised version
- Jul 7, 2026
Malicious code in shopify-internel (npm)
1 compromised version
- Jul 7, 2026
Malicious code in rnx-align-deps (npm)
1 compromised version
- Jul 7, 2026
Malicious code in nonexistent-package (npm)
1 compromised version
- Jul 7, 2026
Malicious code in hook-augmenting-module (npm)
1 compromised version
- Jul 7, 2026
Malicious code in annotator-harvardx (npm)
1 compromised version
- Jul 7, 2026
Malicious code in tx-guard-snap (npm)
1 compromised version
- Jul 7, 2026
Malicious code in jsonschemavalidation (PyPI)
1 compromised version
- Jul 7, 2026
Malicious code in paysafe-sdk (PyPI)
1 compromised version
- Jul 7, 2026
Malicious code in paysafe-payments (PyPI)
1 compromised version
- Jul 7, 2026
Malicious code in paysafe-kyc (PyPI)
1 compromised version
- Jul 7, 2026
Malicious code in paysafe-api (PyPI)
1 compromised version
- Jul 7, 2026
Malicious code in chai-sdk (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in notifier-utils (npm)
4 compromised versions
- Jul 7, 2026
Malicious code in jsf-utils (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in chai-chain-dom (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in typescript-base58 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in crypto-base58 (npm)
5 compromised versions
- Jul 7, 2026
Malicious code in solana-address-codec (npm)
6 compromised versions
- Jul 7, 2026
Malicious code in base58-cli (npm)
6 compromised versions
- Jul 7, 2026
Malicious code in @sqlite-list/schema-generator (npm)
- Jul 7, 2026
Malicious code in @sqlite-list/sql-creator (npm)
- Jul 7, 2026
Malicious code in @sqlite-list/createsql (npm)
- Jul 7, 2026
Malicious code in @sqlite-access/nodesql (npm)
1 compromised version
- Jul 7, 2026
Malicious code in mcp-server-pg (npm)
21 compromised versions
- Jul 7, 2026
Malicious code in @engagehub/test-claim (npm)
- Jul 7, 2026
Malicious code in brunomenozzi-test-pkg (npm)
- Jul 7, 2026
Malicious code in zreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in zircuit-vault (npm)
1 compromised version
- Jul 7, 2026
Malicious code in zircuit-reporter (npm)
1 compromised version
- Jul 7, 2026
Malicious code in zircuit-oracle (npm)
1 compromised version
- Jul 7, 2026
Malicious code in zircuit-keeper (npm)
1 compromised version
- Jul 7, 2026
Malicious code in yreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in wreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in winston-middleware (npm)
39 compromised versions
- Jul 7, 2026
Malicious code in win-env-setup (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in whaleco-assets-json (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in web3-runtime-engine (npm)
1 compromised version
- Jul 7, 2026
Malicious code in wazirx-localtestnpm (npm)
1 compromised version
- Jul 7, 2026
Malicious code in wazir-xlocaletstnpm (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in wallarm-design-system (npm)
1 compromised version
- Jul 7, 2026
Malicious code in vubiquity-website (npm)
1 compromised version
- Jul 7, 2026
Malicious code in vscode-component-explorer (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in vreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in ureactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in treactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in timelycare (npm)
1 compromised version
Page 16 of 5,118