Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,886 total · sorted newest first- Jul 7, 2026
Malicious code in bode-which (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in bmg-user-interaction-tracker (npm)
1 compromised version
- Jul 7, 2026
Malicious code in bitu-wallet (npm)
1 compromised version
- Jul 7, 2026
Malicious code in bitu-user (npm)
1 compromised version
- Jul 7, 2026
Malicious code in bitu-trade (npm)
1 compromised version
- Jul 7, 2026
Malicious code in bitu-sdk (npm)
1 compromised version
- Jul 7, 2026
Malicious code in bitu-protocol (npm)
1 compromised version
- Jul 7, 2026
Malicious code in bitu-core (npm)
1 compromised version
- Jul 7, 2026
Malicious code in bitu-app (npm)
1 compromised version
- Jul 7, 2026
Malicious code in bitopro-trade-guard (npm)
1 compromised version
- Jul 7, 2026
Malicious code in backoff-table (npm)
1 compromised version
- Jul 7, 2026
Malicious code in babelcode_js (npm)
1 compromised version
- Jul 7, 2026
Malicious code in axgularjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in autoprethixer (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in autoprafixar (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in atgularjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in ashcare-ui-ember (npm)
1 compromised version
- Jul 7, 2026
Malicious code in ash-session-tracker (npm)
1 compromised version
- Jul 7, 2026
Malicious code in areactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in apple-mycelium-internal-research (npm)
1 compromised version
- Jul 7, 2026
Malicious code in appauthhelper-enduser (npm)
1 compromised version
- Jul 7, 2026
Malicious code in apache-arrow-17 (npm)
1 compromised version
- Jul 7, 2026
Malicious code in anjularjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in angzlarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angylarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angxlarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angwlarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angvlarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in anguzarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in anguyarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in anguxarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in anguwarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in anguvarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in anguuarjs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angutarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angusarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angurarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in anguparjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in anguoarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angunarjs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angumarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angulzrjs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angulyrjs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angulxrjs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angulwrjs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angulvrjs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angulurjs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angultrjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angulsrjs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angulrrjs (npm)
1 compromised version
Page 21 of 5,118