Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,559 total · sorted newest first- Oct 20, 2026
Malicious code in nwfp-build-config (npm)
2 compromised versions
- Oct 20, 2026
Malware in nwfp-build-config
1 compromised version
- Oct 20, 2026
Malicious code in unicode-title-normalizer (npm)
6 compromised versions
- Oct 20, 2026
Malicious code in formatting-subtitles-for-claude (npm)
2 compromised versions
- Oct 20, 2026
Malware in formatting-subtitles-for-claude
1 compromised version
- Oct 20, 2026
Malware in unicode-title-normalizer
1 compromised version
- Oct 20, 2026
Malicious code in security-research-startup-snapshot-810764b303 (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in research-probe-6150c1c915 (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in workalender (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in workcalender (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in test-workalendar-internal (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in pafex (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in resion (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in workalender (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in pafex (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in resion (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in workcalender (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in test-workalendar-internal (PyPI)
3 compromised versions
- Oct 20, 2026
Malicious code in @platform-services/hrm-mfe-core (npm)
1 compromised version
- Oct 20, 2026
Malicious code in @platform-services/hrm-mfe-core (npm)
1 compromised version
- Oct 20, 2026
Malicious code in sc-announcer (npm)
1 compromised version
- Oct 20, 2026
Malicious code in fanarena-common (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwindcss-visual-kit (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwindcss-motionanimate (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-fabric (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwindcss-animatemotion (npm)
1 compromised version
- Oct 20, 2026
Malicious code in sc-wizard (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-keyframes (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwindcss-keyframe-kit (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwindcss-animate-catalog (npm)
1 compromised version
- Oct 20, 2026
Malicious code in ccl-global-shopping (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwindcss-effect-lab (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-animationlab (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-luminary (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animate-twcss-bridge (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-css-keyframes (npm)
1 compromised version
- Oct 20, 2026
Malicious code in signalledger-diagnostics (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-animatecss-kit (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animate-tailwind-kit (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-animate-kit (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-graphic (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animate-twcss-pack (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-vectrix (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-kinetic (npm)
1 compromised version
- Oct 20, 2026
Malicious code in signalledger-bridge (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-plugin (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-presets (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-helper (npm)
1 compromised version
- Oct 20, 2026
Malicious code in animatecss-tailwind-binary (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-animaflow-kit (npm)
1 compromised version
Page 30 of 7,312