Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,178 total · sorted newest first- Aug 14, 2025
Malicious code in eslint-plugin-react-internal (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-pb (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-market (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-lwc (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-kg-jslint-codeanalyzers (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-jasmine-augmentedreality-airbnb (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-got-ursa-taurus (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-es-spec (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-coda-rules (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-cli (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-automation-custom (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-airbnb-base (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-airbnb (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-aether-phenomic-redis (npm)
- Aug 14, 2025
Malicious code in eslint-jabbah-europa-markdown (npm)
- Aug 14, 2025
Malicious code in eslint-config-yandex-morda (npm)
- Aug 14, 2025
Malicious code in eslint-config-xtdet (npm)
- Aug 14, 2025
Malicious code in eslint-config-volebonet (npm)
- Aug 14, 2025
Malicious code in eslint-config-techintouch (npm)
- Aug 14, 2025
Malicious code in eslint-config-starry (npm)
- Aug 14, 2025
Malicious code in eslint-config-skyscanner-test (npm)
- Aug 14, 2025
Malicious code in eslint-config-sebastienbarre (npm)
- Aug 14, 2025
Malicious code in eslint-config-public-archaeometry-paleontology (npm)
- Aug 14, 2025
Malicious code in eslint-config-pardel (npm)
- Aug 14, 2025
Malicious code in eslint-config-ok (npm)
- Aug 14, 2025
Malicious code in eslint-config-lendesk (npm)
- Aug 14, 2025
Malicious code in eslint-config-kptests (npm)
- Aug 14, 2025
Malicious code in eslint-config-jitsi (npm)
- Aug 14, 2025
Malicious code in eslint-config-iot-app-kit (npm)
- Aug 14, 2025
Malicious code in eslint-config-inectum (npm)
- Aug 14, 2025
Malicious code in eslint-config-googlejs-es6 (npm)
1 compromised version
- Aug 14, 2025
Malicious code in eslint-config-gacrux-hercules-element-ui (npm)
- Aug 14, 2025
Malicious code in eslint-config-frantic1048 (npm)
- Aug 14, 2025
Malicious code in eslint-config-earnest (npm)
- Aug 14, 2025
Malicious code in eslint-config-data-ui (npm)
- Aug 14, 2025
Malicious code in eslint-config-coupang (npm)
- Aug 14, 2025
Malicious code in eslint-config-colourbox-example (npm)
- Aug 14, 2025
Malicious code in eslint-config-10up (npm)
- Aug 14, 2025
Malicious code in eslectron (npm)
- Aug 14, 2025
Malicious code in eskema (npm)
- Aug 14, 2025
Malicious code in esgpsdemo (npm)
- Aug 14, 2025
Malicious code in escape-hatch-tooling (npm)
- Aug 14, 2025
Malicious code in esbuild-linux-arm32 (npm)
- Aug 14, 2025
Malicious code in esba (npm)
- Aug 14, 2025
Malicious code in esales-frontend (npm)
- Aug 14, 2025
Malicious code in es6templatetest (npm)
- Aug 14, 2025
Malicious code in es6guardian (npm)
- Aug 14, 2025
Malicious code in es6-prmoise (npm)
- Aug 14, 2025
Malicious code in es6-http-status-codes (npm)
- Aug 14, 2025
Malicious code in es6-demo-react-npm2 (npm)
Page 6055 of 7,324