Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,836 total · sorted newest first- Oct 1, 2026
Malware in my-ctf-helper-script-9921
1 compromised version
- Oct 1, 2026
Malware in pf23727
1 compromised version
- Oct 1, 2026
Malware in pf25262
1 compromised version
- Oct 1, 2026
Malware in pflag14570
1 compromised version
- Oct 1, 2026
Malware in pulse-pwn-9f3a2
1 compromised version
- Oct 1, 2026
Malware in pflag29424
1 compromised version
- Oct 1, 2026
Malware in pf25133
1 compromised version
- Oct 1, 2026
Malicious code in set-egs-backend (npm)
1 compromised version
- Oct 1, 2026
Malicious code in mms-ref-dedserver (npm)
1 compromised version
- Oct 1, 2026
Malicious code in store-service-worker (npm)
1 compromised version
- Oct 1, 2026
Malicious code in mms-ref-client (npm)
1 compromised version
- Oct 1, 2026
Malicious code in qa-egs-rollback (npm)
1 compromised version
- Oct 1, 2026
Malicious code in generator-epic-react (npm)
1 compromised version
- Oct 1, 2026
Malicious code in mod-manager (npm)
1 compromised version
- Oct 1, 2026
Malicious code in ssp-config-management-tool (npm)
1 compromised version
- Oct 1, 2026
Malicious code in player-support-tools-ui (npm)
1 compromised version
- Oct 1, 2026
Malicious code in mms-simulation (npm)
1 compromised version
- Oct 1, 2026
Malicious code in mms-service (npm)
1 compromised version
- Oct 1, 2026
Malicious code in mms-tools (npm)
1 compromised version
- Oct 1, 2026
Malicious code in mms-thin-client (npm)
1 compromised version
- Oct 1, 2026
Malicious code in @bluewin/utils (npm)
1 compromised version
- Sep 30, 2026
Malicious code in beautifytext (PyPI)
1 compromised version
- Sep 30, 2026
Malicious code in friendly-greeting-tools (PyPI)
1 compromised version
- Sep 30, 2026
Malware in ddok-modal
1 compromised version
- Sep 30, 2026
Malicious code in com.epi.e2e_test (npm)
1 compromised version
- Sep 30, 2026
Malicious code in friendly-greeting-tools (PyPI)
11 compromised versions
- Sep 30, 2026
Malicious code in com.epi.e2e_test (npm)
1 compromised version
- Sep 30, 2026
Malicious code in my-baileys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in lilys-baileys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in noverojs (npm)
1 compromised version
- Sep 30, 2026
Malicious code in noxleyss (npm)
1 compromised version
- Sep 30, 2026
Malicious code in xzbails (npm)
1 compromised version
- Sep 30, 2026
Malicious code in monte-md-baileys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in kasabaileys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in xvinleys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in noxxleys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in spencer-baileys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in keithbaileys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in kiyoramarkets (npm)
1 compromised version
- Sep 30, 2026
Malicious code in eliteprotech-baileys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in yonzoffic-baileys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in syncxbails (npm)
1 compromised version
- Sep 30, 2026
Malicious code in ishumdz-bail (npm)
1 compromised version
- Sep 30, 2026
Malicious code in saturn-baileys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in whalibmob (npm)
1 compromised version
- Sep 30, 2026
Malicious code in xzvexpzcbailey (npm)
1 compromised version
- Sep 30, 2026
Malicious code in levvleys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in focashi (npm)
1 compromised version
- Sep 30, 2026
Malicious code in shadowmd (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @xayz/baileys (npm)
1 compromised version
Page 46 of 7,297