Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,886 total · sorted newest first- Jul 7, 2026
Malicious code in anguladjs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angulacjs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angulabjs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angulaajs (npm)
1 compromised version
- Jul 7, 2026
Malicious code in angukarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angujarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in anguiarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in anguharjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angugarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angufarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in anguearjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angudarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angucarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in angubarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in anguaarjs (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in amgularjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in amazon-data (npm)
1 compromised version
- Jul 7, 2026
Malicious code in amazon-core (npm)
1 compromised version
- Jul 7, 2026
Malicious code in ajgularjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in aigularjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in ai-devops-helper (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in adminui-deps (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in aangularjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in @xp-utilities/web (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @xp-utilities/utilities (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @walkme-ng/shared-ui (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in @vwfs-uix/core (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in @vmo-community/video-player (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @tslogger/pino-pretty-logger (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @trp-ii-ii-component-library/ii-components (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @tostringtag/nsettostringtag (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @toprimitive/nif (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @tc-core/sso-service (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @tc-core/member-service (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @tc-core/auth-service (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @spinstorm/typescript-config (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @spinstorm/eslint-config (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @spinstorm/derng (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @sbb-rsu/ui-banners (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @rocket.chat_mkb/emitter (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @pyme-shared/auth (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @mts-pay/web-sdk (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @microsop/apple-mycelium-integrity-check (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @maximvs1538/os-npm (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @magcd/pino-pretty-logger (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @lovenight/voice (npm)
5 compromised versions
- Jul 7, 2026
Malicious code in @louisvuitton/configurator-common-lib (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @keydev/pino-pretty-logger (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @karakuri-web-fgsfgehfg/common (npm)
1 compromised version
- Jul 7, 2026
Malicious code in @jesusvizcaino2021/app-push-base (npm)
1 compromised version
Page 23 of 5,118