Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,516 total · sorted newest first- Nov 4, 2026
Malicious code in @ai-ecoverse/slicc-windows-amd64 (npm)
1 compromised version
- Nov 4, 2026
Malware in @ai-ecoverse/slicc-windows-amd64
1 compromised version
- Nov 4, 2026
Malicious code in extera-plugin-runtime (PyPI)
2 compromised versions
- Nov 4, 2026
Malicious code in screenshot-desktop (npm)
1 compromised version
- Nov 4, 2026
Malware in screenshot-desktop
1 compromised version
- Nov 4, 2026
Malicious code in smooth_angelfish_emerald-54 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in temporary_smelt_lavender-81 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in xenacious_kangaroo_blush-47 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in specific_sheep_violet-22 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in sound_deer_apricot-15 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in valid_antlion_amber-50 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in unfortunate_crawdad_emerald-79 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in intimate_ostrich_amethyst-45 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in southern_duck_tan-16 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in motionless_mandrill_blush-51 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in itchy_gecko_magenta-98 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in pure_opossum_amaranth-54 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in hushed_zebra_green-81 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in inadequate_earwig_magenta-66 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in hollow_wildebeest_silver-94 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in gugodapis (npm)
1 compromised version
- Nov 4, 2026
Malicious code in et_phone_home (npm)
1 compromised version
- Nov 4, 2026
Malicious code in babyyodaa (npm)
1 compromised version
- Nov 4, 2026
Malicious code in colossal_wallaby_pink-87 (npm)
1 compromised version
- Nov 4, 2026
Malicious code in @signals-notebook/annotation-editor (npm)
1 compromised version
- Nov 4, 2026
Malicious code in @ubedsockets/baileys (npm)
1 compromised version
- Nov 4, 2026
Malicious code in @atfm/utils (npm)
1 compromised version
- Nov 4, 2026
Malicious code in @ifasn/ms-doc-mcp (npm)
1 compromised version
- Nov 4, 2026
Malicious code in @atfm/atfm-material-ui (npm)
1 compromised version
- Nov 4, 2026
Malicious code in @ifasn/ms-doc-mcp (npm)
2 compromised versions
- Nov 4, 2026
Malicious code in brida-frida-hooks (RubyGems)
1 compromised version
- Nov 4, 2026
Malicious code in w002yardprobe (RubyGems)
1 compromised version
- Nov 4, 2026
Malicious code in w002yardprobe (RubyGems)
2 compromised versions
- Nov 4, 2026
Malicious code in brida-frida-hooks (RubyGems)
1 compromised version
- Nov 4, 2026
Malicious code in yzx-npm (npm)
2 compromised versions
- Nov 4, 2026
Malware in yzx-npm
1 compromised version
- Nov 4, 2026
Malicious code in mocha-ui-themes (npm)
- Nov 4, 2026
Malware in mocha-ui-themes
1 compromised version
- Nov 4, 2026
Malicious code in protecteda (PyPI)
1 compromised version
- Nov 4, 2026
Malicious code in ln9qw38745g (PyPI)
1 compromised version
- Nov 4, 2026
Malicious code in zyto (PyPI)
1 compromised version
- Nov 4, 2026
Malicious code in tailwind-form-core (npm)
1 compromised version
- Nov 4, 2026
Malware in tailwind-form-core
1 compromised version
- Nov 4, 2026
Malicious code in react-contact-forms (npm)
1 compromised version
- Nov 4, 2026
Malware in tailwind-forms-kit
1 compromised version
- Nov 4, 2026
Malware in react-contact-forms
1 compromised version
- Nov 4, 2026
Malicious code in tailwind-input-kit (npm)
1 compromised version
- Nov 4, 2026
Malware in tailwind-input-kit
1 compromised version
- Nov 4, 2026
Malware in tailwindcss-contact-form
1 compromised version
- Nov 4, 2026
Malware in tailwindcss-form-utils
1 compromised version
Page 5 of 7,311