Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,559 total · sorted newest first- Oct 19, 2026
Malicious code in tailwindcss-keyframe-kit (npm)
4 compromised versions
- Oct 19, 2026
Malicious code in tailwindcss-effect-lab (npm)
2 compromised versions
- Oct 19, 2026
Malicious code in tailwindcss-animatemotion (npm)
1 compromised version
- Oct 19, 2026
Malicious code in tailwindcss-animate-catalog (npm)
3 compromised versions
- Oct 19, 2026
Malicious code in tailwind-kinetic (npm)
3 compromised versions
- Oct 19, 2026
Malicious code in tailwind-keyframes (npm)
2 compromised versions
- Oct 19, 2026
Malicious code in tailwind-fabric (npm)
2 compromised versions
- Oct 19, 2026
Malicious code in tailwind-css-keyframes (npm)
1 compromised version
- Oct 19, 2026
Malicious code in tailwind-animationlab (npm)
2 compromised versions
- Oct 19, 2026
Malicious code in tailwind-animatecss-kit (npm)
1 compromised version
- Oct 19, 2026
Malicious code in tailwind-animate-kit (npm)
4 compromised versions
- Oct 19, 2026
Malicious code in tailwind-animaflow-kit (npm)
1 compromised version
- Oct 19, 2026
Malicious code in signalledger-diagnostics (npm)
1 compromised version
- Oct 19, 2026
Malicious code in signalledger-bridge (npm)
1 compromised version
- Oct 19, 2026
Malicious code in animatecss-tailwind-vectrix (npm)
2 compromised versions
- Oct 19, 2026
Malicious code in animatecss-tailwind-presets (npm)
2 compromised versions
- Oct 19, 2026
Malicious code in animatecss-tailwind-plugin (npm)
1 compromised version
- Oct 19, 2026
Malicious code in animatecss-tailwind-luminary (npm)
2 compromised versions
- Oct 19, 2026
Malicious code in animatecss-tailwind-helper (npm)
1 compromised version
- Oct 19, 2026
Malicious code in animatecss-tailwind-graphic (npm)
1 compromised version
- Oct 19, 2026
Malicious code in animatecss-tailwind-binary (npm)
1 compromised version
- Oct 19, 2026
Malicious code in animate-twcss-pack (npm)
1 compromised version
- Oct 19, 2026
Malicious code in animate-twcss-bridge (npm)
1 compromised version
- Oct 19, 2026
Malicious code in animate-tailwind-kit (npm)
2 compromised versions
- Oct 18, 2026
Malicious code in @pkgship/frpc-linux-arm64 (npm)
1 compromised version
- Oct 18, 2026
Malware in @pkgship/frpc-linux-arm64
1 compromised version
- Oct 18, 2026
Malicious code in rootaccessxvv-bbmarker (npm)
1 compromised version
- Oct 18, 2026
Malicious code in leakdeep (PyPI)
1 compromised version
- Oct 18, 2026
Malicious code in leakdeep (PyPI)
9 compromised versions
- Oct 17, 2026
Malicious code in pyrechoasr (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in voltswannts (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in ukraine69 (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in quasitonnts (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in tonemaptts (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in novalithtts (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in emberlytts (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in driftwavets (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in glassbeakasr (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in tonemaptts (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in pyrechoasr (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in driftwavets (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in novalithtts (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in voltswannts (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in glassbeakasr (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in emberlytts (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in quasitonnts (PyPI)
1 compromised version
- Oct 17, 2026
Malicious code in ukraine69 (PyPI)
8 compromised versions
- Oct 16, 2026
Malicious code in itsa-react-maskedinput (npm)
1 compromised version
- Oct 16, 2026
Malware in itsa-react-maskedinput
1 compromised version
- Oct 16, 2026
Malicious code in itsa-react-focuscontainer (npm)
1 compromised version
Page 37 of 7,312