Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,284 total · sorted newest first- Sep 15, 2026
Malware in kartykp-token-pkg
1 compromised version
- Sep 15, 2026
Malicious code in tol8t (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-yayccresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-tryccresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-rs-meeb322k (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-sucresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in fulfillment-cuprum-auth-widget (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-plsresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in process-tailwind (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-resh-meeb322k (npm)
1 compromised version
- Sep 15, 2026
Malicious code in csa-mfa (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-revs01-meeb322k (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-revs02-meeb322k (npm)
1 compromised version
- Sep 15, 2026
Malicious code in chai-as-crack (npm)
1 compromised version
- Sep 15, 2026
Malicious code in process-lhpm (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-revs-meeb322k (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-revsh-meeb322k (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-uicc-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-weccresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-ccresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in alkajsdfoiwqeusdflkjsdf (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-proccresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-yesccresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in n8n-nodes-buildcheck (npm)
1 compromised version
- Sep 15, 2026
Malicious code in bender-rspack-config (npm)
1 compromised version
- Sep 15, 2026
Malicious code in chai-as-crack (npm)
1 compromised version
- Sep 15, 2026
Malware in tailwind-forms-styles
1 compromised version
- Sep 15, 2026
Malicious code in alkajsdfoiwqeusdflkjsdf (npm)
1 compromised version
- Sep 15, 2026
Malicious code in fulfillment-cuprum-auth-widget (npm)
4 compromised versions
- Sep 15, 2026
Malicious code in strapi-plugin-weccresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in process-tailwind (npm)
1 compromised version
- Sep 15, 2026
Malicious code in process-lhpm (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-uicc-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in tailwind-forms-styles (npm)
2 compromised versions
- Sep 15, 2026
Malicious code in strapi-plugin-revs-meeb322k (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-yesccresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-revsh-meeb322k (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-sucresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-yayccresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-revs02-meeb322k (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-revs01-meeb322k (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-proccresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in n8n-nodes-buildcheck (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-resh-meeb322k (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-tryccresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-rs-meeb322k (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-plsresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in strapi-plugin-ccresh-meeb (npm)
1 compromised version
- Sep 15, 2026
Malicious code in csa-mfa (npm)
2 compromised versions
- Sep 15, 2026
Malicious code in @biz44/id95-client (npm)
1 compromised version
Page 343 of 7,326