Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,886 total · sorted newest first- Jul 7, 2026
Malicious code in elf-stats-storybook-snowman-513 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-starlit-snowglobe-806 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-snowdusted-bauble-546 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-silvered-sled-455 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-shimmering-cushion-351 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-peppermint-northstar-168 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-merry-snowflake-893 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-merry-hollyberry-699 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-merry-fir-592 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-marzipan-sled-824 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-marzipan-saddlebag-291 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-lanternlit-giftbox-663 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-jolly-saddlebag-184 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-holly-bauble-986 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-glittering-cushion-945 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-fuzzy-ribbon-874 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-frosty-hammer-191 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-festive-pantry-640 (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in elf-stats-cosy-drum-671 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-candlelit-pantry-649 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-bright-workbench-558 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-bright-star-581 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in elf-stats-bright-nutcracker-546 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in dwagger-express-router (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in dreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in dpd-security-poc (npm)
1 compromised version
- Jul 7, 2026
Malicious code in dontawesome (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in divvy-web (npm)
1 compromised version
- Jul 7, 2026
Malicious code in csec-form-helpers (npm)
1 compromised version
- Jul 7, 2026
Malicious code in csec-crypto-utils (npm)
1 compromised version
- Jul 7, 2026
Malicious code in cookie-parseflow (npm)
1 compromised version
- Jul 7, 2026
Malicious code in cli-pretty-logger (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chalk-standard (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chai-fetchs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chai-extention-utils (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chai-chain-test (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in chai-as-upgraded (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chai-as-test (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chai-as-sai (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chai-as-purified (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chai-as-patched (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in chai-as-legit (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chai-as-launched (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chai-as-informed (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chai-as-consisted (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chai-as-commited (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in chai-as-belonged (npm)
1 compromised version
- Jul 7, 2026
Malicious code in chai-as-absorbed (npm)
1 compromised version
- Jul 7, 2026
Malicious code in breactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in box-ui-elements-usm (npm)
1 compromised version
Page 20 of 5,118