Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
225,882 total · sorted newest first- May 19, 2026
Malicious code in timeago.js (npm)
2 compromised versions
- May 19, 2026
Malicious code in timeago-react (npm)
2 compromised versions
- May 19, 2026
Malicious code in slice.js (npm)
2 compromised versions
- May 19, 2026
Malicious code in size-sensor (npm)
3 compromised versions
- May 19, 2026
Malicious code in ribbon.js (npm)
1 compromised version
- May 19, 2026
Malicious code in relationship.js (npm)
2 compromised versions
- May 19, 2026
Malicious code in react-adsense (npm)
2 compromised versions
- May 19, 2026
Malicious code in onfire.js (npm)
2 compromised versions
- May 19, 2026
Malicious code in miz (npm)
2 compromised versions
- May 19, 2026
Malicious code in mcp-mermaid (npm)
2 compromised versions
- May 19, 2026
Malicious code in mcp-echarts (npm)
2 compromised versions
- May 19, 2026
Malicious code in lint-md-cli (npm)
2 compromised versions
- May 19, 2026
Malicious code in lint-md (npm)
2 compromised versions
- May 19, 2026
Malicious code in limit-size (npm)
2 compromised versions
- May 19, 2026
Malicious code in jest-url-loader (npm)
2 compromised versions
- May 19, 2026
Malicious code in jest-random-mock (npm)
2 compromised versions
- May 19, 2026
Malicious code in jest-less-loader (npm)
2 compromised versions
- May 19, 2026
Malicious code in jest-expect (npm)
2 compromised versions
- May 19, 2026
Malicious code in jest-electron (npm)
2 compromised versions
- May 19, 2026
Malicious code in jest-date-mock (npm)
3 compromised versions
- May 19, 2026
Malicious code in jest-canvas-mock (npm)
3 compromised versions
- May 19, 2026
Malicious code in gantt-for-react (npm)
2 compromised versions
- May 19, 2026
Malicious code in fixed-round (npm)
2 compromised versions
- May 19, 2026
Malicious code in filesize.js (npm)
2 compromised versions
- May 19, 2026
Malicious code in echarts-for-react (npm)
3 compromised versions
- May 19, 2026
Malicious code in canvas-nest.js (npm)
2 compromised versions
- May 19, 2026
Malicious code in boring-avatars-vanilla (npm)
2 compromised versions
- May 19, 2026
Malicious code in babel-plugin-version (npm)
2 compromised versions
- May 19, 2026
Malicious code in ast-plugin (npm)
2 compromised versions
- May 19, 2026
Malicious code in amapcn (npm)
2 compromised versions
- May 19, 2026
Malicious code in ai-figure (npm)
2 compromised versions
- May 19, 2026
Malicious code in @lint-md/parser (npm)
2 compromised versions
- May 19, 2026
Malicious code in @lint-md/core (npm)
2 compromised versions
- May 19, 2026
Malicious code in @lint-md/cli (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/xflow-hook (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/xflow-extension (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/xflow-diff (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/xflow-core (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/xflow (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/x6-vue3-shape (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/x6-vue-shape (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/x6-vector (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/x6-react-shape (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/x6-react-components (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/x6-react (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/x6-plugin-transform (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/x6-plugin-stencil (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/x6-plugin-snapline (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/x6-plugin-selection (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/x6-plugin-scroller (npm)
2 compromised versions
Page 3 of 4,518