Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,628 total · sorted newest first- Jul 1, 2025
Malicious code in paysafe-wac-web-2fa-lib-fe (npm)
1 compromised version
- Jul 1, 2025
Malware in handelsblatt-hypesignals-ui-components
1 compromised version
- Jul 1, 2025
Malicious code in node-orm-mongoose (npm)
- Jul 1, 2025
Malware in node-orm-mongoose
1 compromised version
- Jul 1, 2025
Malicious code in keythereum-utils (npm)
6 compromised versions
- Jul 1, 2025
Malware in keythereum-utils
1 compromised version
- Jul 1, 2025
Malicious code in react-svg-config (npm)
- Jul 1, 2025
Malware in react-svg-config
1 compromised version
- Jul 1, 2025
Malicious code in zaranian (npm)
1 compromised version
- Jul 1, 2025
Malware in zaranian
1 compromised version
- Jul 1, 2025
Malware in my-not-confused-packages
1 compromised version
- Jul 1, 2025
Malware in my-not-confused-package
1 compromised version
- Jul 1, 2025
Malicious code in os-info-es6 (npm)
- Jul 1, 2025
Malware in os-info-es6
1 compromised version
- Jul 1, 2025
Malicious code in expo-session (npm)
- Jul 1, 2025
Malware in expo-session
1 compromised version
- Jul 1, 2025
Malicious code in workflows-template (npm)
1 compromised version
- Jul 1, 2025
Malicious code in cors-utils (npm)
- Jul 1, 2025
Malicious code in cors-util (npm)
- Jul 1, 2025
Malware in cors-utils
1 compromised version
- Jul 1, 2025
Malware in cors-util
1 compromised version
- Jul 1, 2025
Malicious code in vite-plugin-next-refresh (npm)
- Jul 1, 2025
Malware in vite-plugin-next-refresh
1 compromised version
- Jul 1, 2025
Malicious code in velocky (npm)
- Jul 1, 2025
Malware in velocky
1 compromised version
- Jul 1, 2025
Malicious code in notification-logs (npm)
- Jul 1, 2025
Malicious code in notification-loggers (npm)
- Jul 1, 2025
Malware in notification-logs
1 compromised version
- Jul 1, 2025
Malware in notification-loggers
1 compromised version
- Jul 1, 2025
Malicious code in axios-browseragent (npm)
6 compromised versions
- Jul 1, 2025
Malware in axios-browseragent
1 compromised version
- Jun 30, 2025
Malicious code in cvent-event-calendar (npm)
- Jun 30, 2025
Malicious code in protos-gen-node (npm)
- Jun 30, 2025
Malicious code in bg-core-payments-automation (npm)
- Jun 30, 2025
Malicious code in webgl-fingerprinting (npm)
- Jun 30, 2025
Malicious code in datanerd (npm)
8 compromised versions
- Jun 30, 2025
Malicious code in ee_else_ce (npm)
- Jun 30, 2025
Malicious code in sweet-bananas (npm)
- Jun 30, 2025
Malicious code in betsson (npm)
- Jun 30, 2025
Malicious code in data-layers (npm)
- Jun 30, 2025
Malicious code in log-styles (npm)
- Jun 30, 2025
Malicious code in youku-search (npm)
- Jun 30, 2025
Malicious code in viryc-hsc (npm)
8 compromised versions
- Jun 30, 2025
Malicious code in very-zeld (npm)
- Jun 30, 2025
Malicious code in root-direct (npm)
- Jun 30, 2025
Malicious code in nodyn (npm)
- Jun 30, 2025
Malicious code in node-smskc (npm)
- Jun 30, 2025
Malicious code in node-pretier (npm)
- Jun 30, 2025
Malicious code in node-pkg-cache (npm)
- Jun 30, 2025
Malicious code in nava-clone (npm)
Page 6266 of 7,293