Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,886 total · sorted newest first- Jul 7, 2026
Malicious code in next-runtimejs (npm)
5 compromised versions
- Jul 7, 2026
Malicious code in newsroom-2022 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in mx-frontend (npm)
1 compromised version
- Jul 7, 2026
Malicious code in mwf-accounts-lib-native-call-language-preference (npm)
1 compromised version
- Jul 7, 2026
Malicious code in mreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in motion-ani (npm)
1 compromised version
- Jul 7, 2026
Malicious code in modustack (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in mngularjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in meta-templates (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in mcp-ci-runner-poc (npm)
1 compromised version
- Jul 7, 2026
Malicious code in manage-subscription-app (npm)
1 compromised version
- Jul 7, 2026
Malicious code in lunkr (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in lreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in logfuse (npm)
1 compromised version
- Jul 7, 2026
Malicious code in liportal-web-app (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in lint-prettier (npm)
1 compromised version
- Jul 7, 2026
Malicious code in launchdarkly-ai-tooling (npm)
1 compromised version
- Jul 7, 2026
Malicious code in latency-tracking-internal (npm)
1 compromised version
- Jul 7, 2026
Malicious code in latency-tracking (npm)
1 compromised version
- Jul 7, 2026
Malicious code in lage-npm (npm)
1 compromised version
- Jul 7, 2026
Malicious code in kreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in jwt-path (npm)
1 compromised version
- Jul 7, 2026
Malicious code in jreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in ixpresso-core (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in ireactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in insomnia-plugin-poctest-null0001 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in ingularjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in ict-ui-carbon (npm)
1 compromised version
- Jul 7, 2026
Malicious code in ict-api-foundations (npm)
1 compromised version
- Jul 7, 2026
Malicious code in icons.generated (npm)
1 compromised version
- Jul 7, 2026
Malicious code in ibotta-ts (npm)
1 compromised version
- Jul 7, 2026
Malicious code in iam-scripts (npm)
1 compromised version
- Jul 7, 2026
Malicious code in hreactjs (npm)
4 compromised versions
- Jul 7, 2026
Malicious code in google-tag-manager-integration-sample (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in gontawesome (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in gitpath-package (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in generate-iam-token (npm)
1 compromised version
- Jul 7, 2026
Malicious code in fnnote-monorepo (npm)
1 compromised version
- Jul 7, 2026
Malicious code in fnnote-frontend (npm)
1 compromised version
- Jul 7, 2026
Malicious code in fnnote-combined (npm)
1 compromised version
- Jul 7, 2026
Malicious code in fngularjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in fiat-token-admin (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in fabric-grachics (npm)
1 compromised version
- Jul 7, 2026
Malicious code in express-flowlimit (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in express-denv (npm)
1 compromised version
- Jul 7, 2026
Malicious code in evil-helper-pkg (npm)
1 compromised version
- Jul 7, 2026
Malicious code in eslint-plugin-dagster-rules (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in eslint-plugin-click-ui (npm)
1 compromised version
- Jul 7, 2026
Malicious code in ereactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in elf-stats-storybook-workshop-935 (npm)
1 compromised version
Page 19 of 5,118