Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Aug 14, 2025
Malicious code in react-native-background-geolocation-android (npm)
- Aug 14, 2025
Malicious code in react-native-audio-recorder-android (npm)
- Aug 14, 2025
Malicious code in react-native-apollo-upload-client (npm)
- Aug 14, 2025
Malicious code in react-native-agnavigation (npm)
- Aug 14, 2025
Malicious code in react-naitve-components (npm)
- Aug 14, 2025
Malicious code in react-mutator (npm)
- Aug 14, 2025
Malicious code in react-microphone-controls (npm)
- Aug 14, 2025
Malicious code in react-menu-toolbar (npm)
- Aug 14, 2025
Malicious code in react-launch (npm)
- Aug 14, 2025
Malicious code in react-keel (npm)
- Aug 14, 2025
Malicious code in react-image2base64 (npm)
- Aug 14, 2025
Malicious code in react-i18nify-mobx (npm)
- Aug 14, 2025
Malicious code in react-i18n-swc-plugin (npm)
- Aug 14, 2025
Malicious code in react-hook-eslint (npm)
- Aug 14, 2025
Malicious code in react-headers (npm)
- Aug 14, 2025
Malicious code in react-grid-suite (npm)
- Aug 14, 2025
Malicious code in react-googleplaces-component (npm)
- Aug 14, 2025
Malicious code in react-google-publisher-tag-v15 (npm)
- Aug 14, 2025
Malicious code in react-google-calendar-events (npm)
- Aug 14, 2025
Malicious code in react-found (npm)
- Aug 14, 2025
Malicious code in react-focus-lock-next (npm)
- Aug 14, 2025
Malicious code in react-flyout (npm)
- Aug 14, 2025
Malicious code in react-flipboard (npm)
- Aug 14, 2025
Malicious code in react-flex-dropdowns (npm)
- Aug 14, 2025
Malicious code in react-flamechart (npm)
- Aug 14, 2025
Malicious code in react-fincharts (npm)
- Aug 14, 2025
Malicious code in react-filter-tree (npm)
- Aug 14, 2025
Malicious code in react-fatigue-dev-boiler (npm)
- Aug 14, 2025
Malicious code in react-dropdownhunter (npm)
- Aug 14, 2025
Malicious code in react-dom.js (npm)
- Aug 14, 2025
Malicious code in react-dmo (npm)
- Aug 14, 2025
Malicious code in react-developer-task (npm)
- Aug 14, 2025
Malicious code in react-data-grid-eppsta (npm)
- Aug 14, 2025
Malicious code in react-corn (npm)
2 compromised versions
- Aug 14, 2025
Malicious code in react-context-stylizer (npm)
- Aug 14, 2025
Malicious code in react-component-adbox (npm)
- Aug 14, 2025
Malicious code in react-chtr-object-methods (npm)
- Aug 14, 2025
Malicious code in react-chtr-form (npm)
- Aug 14, 2025
Malicious code in react-choose (npm)
- Aug 14, 2025
Malicious code in react-bootstrap-prettier-stylelint-parsec-mechatronics (npm)
- Aug 14, 2025
Malicious code in react-bootstrap-paleontology-kinetic-luminescence (npm)
- Aug 14, 2025
Malicious code in react-bootstrap-nightwatch-andromeda-mysql (npm)
- Aug 14, 2025
Malicious code in react-bootstrap-mocha-command-scripts (npm)
- Aug 14, 2025
Malicious code in react-babelfish (npm)
- Aug 14, 2025
Malicious code in react-atomic-css (npm)
- Aug 14, 2025
Malicious code in react-aside (npm)
- Aug 14, 2025
Malicious code in react-airbnb-prettier (npm)
1 compromised version
- Aug 14, 2025
Malicious code in react-adblockdetect (npm)
- Aug 14, 2025
Malicious code in react-360-with-awareness (npm)
- Aug 14, 2025
Malicious code in reacct (npm)
Page 5785 of 7,293