Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,886 total · sorted newest first- Jul 7, 2026
Malicious code in reavctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reauctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reatctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rearctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reamctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in realtime-voice-component (npm)
1 compromised version
- Jul 7, 2026
Malicious code in reafctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reacytjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reacxtjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reacvtjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in react-tiny-popover-next (npm)
1 compromised version
- Jul 7, 2026
Malicious code in react-native-paysafe-apple-pay (npm)
1 compromised version
- Jul 7, 2026
Malicious code in react-datepicker-next (npm)
1 compromised version
- Jul 7, 2026
Malicious code in reacrtjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reacptjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reacktjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reachtjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reacetjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reabctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reaactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rdeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rceactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rbeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in raeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in qreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in pull-request-comment-branch (npm)
1 compromised version
- Jul 7, 2026
Malicious code in private-packages-sharingsession (npm)
1 compromised version
- Jul 7, 2026
Malicious code in private-packages-sharing-sessionz (npm)
1 compromised version
- Jul 7, 2026
Malicious code in postgres-docker-utils (npm)
1 compromised version
- Jul 7, 2026
Malicious code in plugin-proposal (npm)
1 compromised version
- Jul 7, 2026
Malicious code in picnic-work-app-terms-of-use-nl (npm)
1 compromised version
- Jul 7, 2026
Malicious code in picnic-work-app-terms-of-use-fr (npm)
1 compromised version
- Jul 7, 2026
Malicious code in picnic-work-app-terms-of-use-de (npm)
1 compromised version
- Jul 7, 2026
Malicious code in picnic-store-page-platform (npm)
1 compromised version
- Jul 7, 2026
Malicious code in picnic-store-design-system (npm)
1 compromised version
- Jul 7, 2026
Malicious code in picnic-store-delivery-miniapp (npm)
1 compromised version
- Jul 7, 2026
Malicious code in picnic-store-basket-miniapp (npm)
1 compromised version
- Jul 7, 2026
Malicious code in picnic-decoder-generator (npm)
1 compromised version
- Jul 7, 2026
Malicious code in penny-core (npm)
1 compromised version
- Jul 7, 2026
Malicious code in pe3-ihm-plateforme (npm)
1 compromised version
- Jul 7, 2026
Malicious code in paypal-legal-components (npm)
1 compromised version
- Jul 7, 2026
Malicious code in oztxrk-mfa (npm)
1 compromised version
- Jul 7, 2026
Malicious code in ovault-evm (npm)
1 compromised version
- Jul 7, 2026
Malicious code in outer-package (npm)
1 compromised version
- Jul 7, 2026
Malicious code in oreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in options-msg (npm)
6 compromised versions
- Jul 7, 2026
Malicious code in oidcsessioncheck-enduser (npm)
1 compromised version
- Jul 7, 2026
Malicious code in nreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in notepad-monorepo (npm)
1 compromised version
- Jul 7, 2026
Malicious code in notepad-frontend (npm)
1 compromised version
Page 18 of 5,118