Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,559 total · sorted newest first- Oct 21, 2026
Malicious code in my-auto-follow-eltio (npm)
1 compromised version
- Oct 21, 2026
Malware in my-auto-follow-eltio
1 compromised version
- Oct 21, 2026
Malware in @dreamguyxeon/libsignal-node
1 compromised version
- Oct 21, 2026
Malware in @dreamguyxeon/baileyx
1 compromised version
- Oct 21, 2026
Malware in my-auto-follow
1 compromised version
- Oct 21, 2026
Malicious code in @alannxd/baileys (npm)
27 compromised versions
- Oct 21, 2026
Malware in @alannxd/baileys
1 compromised version
- Oct 21, 2026
Malicious code in debbug (PyPI)
1 compromised version
- Oct 21, 2026
Malicious code in jiklpo-tsunari-kay (PyPI)
1 compromised version
- Oct 21, 2026
Malicious code in ssemver (PyPI)
1 compromised version
- Oct 21, 2026
Malicious code in hijiko-pilaka (PyPI)
1 compromised version
- Oct 21, 2026
Malicious code in deebug (PyPI)
1 compromised version
- Oct 21, 2026
Malicious code in trijigo-kalip (PyPI)
1 compromised version
- Oct 21, 2026
Malicious code in facewareretargeter (PyPI)
1 compromised version
- Oct 21, 2026
Malicious code in hijok-lampam (PyPI)
1 compromised version
- Oct 21, 2026
Malicious code in semer (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in ssemver (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semer (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in debbug (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in deebug (PyPI)
1 compromised version
- Oct 20, 2026
Malware in animatecss-tailwind-bridge
1 compromised version
- Oct 20, 2026
Malicious code in tellyo-colours (npm)
3 compromised versions
- Oct 20, 2026
Malware in tostpro
1 compromised version
- Oct 20, 2026
Malware in tellyo-colours
1 compromised version
- Oct 20, 2026
Malware in abbishal-poc-as-dependency
1 compromised version
- Oct 20, 2026
Malware in @ziedzzz/demo-canary
1 compromised version
- Oct 20, 2026
Malware in tinkoff-cache-path
1 compromised version
- Oct 20, 2026
Malware in eacq-payform-core
1 compromised version
- Oct 20, 2026
Malicious code in rs-lookout-sandbox-poc (npm)
1 compromised version
- Oct 20, 2026
Malicious code in memories-core-web (npm)
1 compromised version
- Oct 20, 2026
Malicious code in rootaccessxvv-bbmarker (npm)
1 compromised version
- Oct 20, 2026
Malicious code in @securihackbot/depconf-stage-1792484738 (npm)
1 compromised version
- Oct 20, 2026
Malicious code in hijok-lampam (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in trijigo-kalip (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in jiklpo-tsunari-kay (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in hijiko-pilaka (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in facewareretargeter (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in @securihackbot/depconf-stage-1792484738 (npm)
1 compromised version
- Oct 20, 2026
Malicious code in rs-lookout-sandbox-poc (npm)
1 compromised version
- Oct 20, 2026
Malicious code in memories-core-web (npm)
1 compromised version
- Oct 20, 2026
Malicious code in semveer (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semmver (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semverr (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in security-research-startup-snapshot-810764b303 (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semvver (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in research-probe-6150c1c915 (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semvver (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semveer (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semmver (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semverr (PyPI)
1 compromised version
Page 29 of 7,312