Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,559 total · sorted newest first- Oct 19, 2026
Malicious code in mxckjdgweuxpsiohd (npm)
3 compromised versions
- Oct 19, 2026
Malicious code in mx3dxhgic8xhd6 (npm)
2 compromised versions
- Oct 19, 2026
Malware in mxckjdgweuxpsiohd
1 compromised version
- Oct 19, 2026
Malware in nsdhjuiwqxmhsf1
1 compromised version
- Oct 19, 2026
Malware in vjkpwjxbvndelta
1 compromised version
- Oct 19, 2026
Malware in ticketcathayoct12
1 compromised version
- Oct 19, 2026
Malware in mx3dxhgic8xhd6
1 compromised version
- Oct 19, 2026
Malware in zxhgssiyluwxchn
1 compromised version
- Oct 19, 2026
Malicious code in sc-geeksquad-core (npm)
1 compromised version
- Oct 19, 2026
Malicious code in sc-font-icons (npm)
1 compromised version
- Oct 19, 2026
Malicious code in zeroz-baileys (npm)
1 compromised version
- Oct 19, 2026
Malicious code in aldi02-baileys (npm)
- Oct 19, 2026
Malicious code in aemath-baileys (npm)
- Oct 19, 2026
Malicious code in ichigo-baileys (npm)
2 compromised versions
- Oct 19, 2026
Malware in zero-baileys
1 compromised version
- Oct 19, 2026
Malware in aemath-baileys
1 compromised version
- Oct 19, 2026
Malware in ichigo-baileys
1 compromised version
- Oct 19, 2026
Malware in zeroz-baileys
1 compromised version
- Oct 19, 2026
Malware in aldi02-baileys
1 compromised version
- Oct 19, 2026
Malicious code in item-validator (npm)
- Oct 19, 2026
Malware in items-validator
1 compromised version
- Oct 19, 2026
Malware in item-validator
1 compromised version
- Oct 19, 2026
Malicious code in rubbydev-crash-baileys (npm)
1 compromised version
- Oct 19, 2026
Malware in rubbydev-crash-baileys
1 compromised version
- Oct 19, 2026
Malicious code in prastzyy (npm)
1 compromised version
- Oct 19, 2026
Malware in prastzyy
1 compromised version
- Oct 19, 2026
Malicious code in xcvrenzcompany (npm)
2 compromised versions
- Oct 19, 2026
Malicious code in prastzy (npm)
1 compromised version
- Oct 19, 2026
Malicious code in xzvexpzcbailey (npm)
4 compromised versions
- Oct 19, 2026
Malicious code in xzbails (npm)
3 compromised versions
- Oct 19, 2026
Malware in prastzy
1 compromised version
- Oct 19, 2026
Malware in xzvexpzcbailey
1 compromised version
- Oct 19, 2026
Malware in xzbails
1 compromised version
- Oct 19, 2026
Malware in xcvrenzcompany
1 compromised version
- Oct 19, 2026
Malicious code in @apexacc/cli (npm)
1 compromised version
- Oct 19, 2026
Malicious code in @apexacc/audit (npm)
1 compromised version
- Oct 19, 2026
Malicious code in @fmr-ap149494/apex-base-component (npm)
1 compromised version
- Oct 19, 2026
Malicious code in fabdeploycheck (PyPI)
1 compromised version
- Oct 19, 2026
Malicious code in fabtoolkit (PyPI)
1 compromised version
- Oct 19, 2026
Malicious code in @fcsmc/commercial-analytics (npm)
1 compromised version
- Oct 19, 2026
Malicious code in @fmr-ap149494/apex-base-component (npm)
1 compromised version
- Oct 19, 2026
Malicious code in @fcsmc/commercial-analytics (npm)
1 compromised version
- Oct 19, 2026
Malicious code in fabdeploycheck (PyPI)
1 compromised version
- Oct 19, 2026
Malicious code in fabtoolkit (PyPI)
5 compromised versions
- Oct 19, 2026
Malicious code in @fluxionii/baileys (npm)
- Oct 19, 2026
Malicious code in @ostyado/baileys (npm)
4 compromised versions
- Oct 19, 2026
Malware in @ostyado/baileys
1 compromised version
- Oct 19, 2026
Malware in @fluxionii/baileys
1 compromised version
- Oct 19, 2026
Malicious code in tailwindcss-visual-kit (npm)
2 compromised versions
- Oct 19, 2026
Malicious code in tailwindcss-motionanimate (npm)
1 compromised version
Page 36 of 7,312