Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,565 total · sorted newest first- Oct 3, 2026
Malicious code in @angularr/cli (npm)
1 compromised version
- Oct 3, 2026
Malicious code in echogen (PyPI)
1 compromised version
- Oct 3, 2026
Malicious code in voxel-tts (PyPI)
1 compromised version
- Oct 3, 2026
Malicious code in voxcpmtts3 (PyPI)
1 compromised version
- Oct 3, 2026
Malicious code in express-enhanced (npm)
1 compromised version
- Oct 3, 2026
Malicious code in express-fork (npm)
1 compromised version
- Oct 3, 2026
Malicious code in echogen (PyPI)
1 compromised version
- Oct 3, 2026
Malicious code in voxcpmtts3 (PyPI)
3 compromised versions
- Oct 3, 2026
Malicious code in voxel-tts (PyPI)
2 compromised versions
- Oct 3, 2026
Malicious code in voxeval (PyPI)
1 compromised version
- Oct 2, 2026
Malware in mfahelper
1 compromised version
- Oct 2, 2026
Malware in @woodpecker-web-shared/components
1 compromised version
- Oct 2, 2026
Malware in bnppf-flag-icons
1 compromised version
- Oct 2, 2026
Malware in turbo-ws
1 compromised version
- Oct 2, 2026
Malware in hardhat-zet
1 compromised version
- Oct 2, 2026
Malicious code in @smwebserver/static (npm)
1 compromised version
- Oct 2, 2026
Malicious code in voxeval (PyPI)
4 compromised versions
- Oct 2, 2026
Malicious code in ui.dist.min.js (npm)
- Oct 2, 2026
Malicious code in ui-base-colors (npm)
- Oct 2, 2026
Malicious code in translate-base-font (npm)
1 compromised version
- Oct 2, 2026
Malware in ui-base-colors
1 compromised version
- Oct 2, 2026
Malware in translate-base-font
1 compromised version
- Oct 2, 2026
Malware in ui.dist.min.js
1 compromised version
- Oct 2, 2026
Malicious code in @smwebserver/static (npm)
1 compromised version
- Oct 2, 2026
Malicious code in dedh-devops-automation (PyPI)
1 compromised version
- Oct 2, 2026
Malicious code in dedh-devops-automation (PyPI)
8 compromised versions
- Oct 2, 2026
Malicious code in gocommunity.io/orderedbtree (Go)
1 compromised version
- Oct 2, 2026
Malicious code in gogets.dev/btreex (Go)
1 compromised version
- Oct 2, 2026
Malicious code in wailib (npm)
1 compromised version
- Oct 2, 2026
Malicious code in ai-workshop-radio-app (npm)
1 compromised version
- Oct 2, 2026
Malicious code in luoxy-baileys (npm)
1 compromised version
- Oct 2, 2026
Malicious code in prastzy (npm)
1 compromised version
- Oct 2, 2026
Malicious code in mikuhostt-baileys (npm)
1 compromised version
- Oct 2, 2026
Malicious code in live-detection-dashboard (npm)
1 compromised version
- Oct 2, 2026
Malicious code in alexa-cybertron-team-code-review-agent (npm)
1 compromised version
- Oct 2, 2026
Malicious code in niksinnkatalapp (npm)
1 compromised version
- Oct 2, 2026
Malicious code in figma-to-apl (npm)
1 compromised version
- Oct 2, 2026
Malicious code in @bluewin/utils (npm)
1 compromised version
- Oct 2, 2026
Malicious code in brioche-apl-dev-env (npm)
1 compromised version
- Oct 2, 2026
Malicious code in danz-bails (npm)
1 compromised version
- Oct 2, 2026
Malicious code in okra-cloud-cdk (npm)
1 compromised version
- Oct 2, 2026
Malicious code in apl-rive-renderer (npm)
1 compromised version
- Oct 2, 2026
Malicious code in ai-workshop-maa15-radio (npm)
1 compromised version
- Oct 2, 2026
Malicious code in xcvrenzcompany (npm)
1 compromised version
- Oct 2, 2026
Malicious code in @zanta/baileys (npm)
1 compromised version
- Oct 2, 2026
Malicious code in ai-workshop-radio-lambda (npm)
1 compromised version
- Oct 2, 2026
Malicious code in rubbydev-crash-baileys (npm)
1 compromised version
- Oct 2, 2026
Malicious code in prastzyy (npm)
1 compromised version
- Oct 2, 2026
Malicious code in @smart-dev-wa/baileys (npm)
1 compromised version
- Oct 2, 2026
Malicious code in @celestial-community/baileys (npm)
1 compromised version
Page 59 of 7,312