Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Jun 10, 2025
Malicious code in typeface-myriad-pro (npm)
1 compromised version
- Jun 10, 2025
Malware in typeface-myriad-pro
1 compromised version
- Jun 10, 2025
Malicious code in throttling-proxy (npm)
1 compromised version
- Jun 10, 2025
Malware in throttling-proxy
1 compromised version
- Jun 10, 2025
Malicious code in tedious-types (npm)
1 compromised version
- Jun 10, 2025
Malware in tedious-types
1 compromised version
- Jun 10, 2025
Malicious code in svelte-local-storage (npm)
1 compromised version
- Jun 10, 2025
Malware in svelte-local-storage
1 compromised version
- Jun 10, 2025
Malicious code in statsmodels (npm)
1 compromised version
- Jun 10, 2025
Malware in statsmodels
1 compromised version
- Jun 10, 2025
Malicious code in spring-security-test (npm)
1 compromised version
- Jun 10, 2025
Malware in spring-security-test
1 compromised version
- Jun 10, 2025
Malicious code in scrapy-user-agents (npm)
1 compromised version
- Jun 10, 2025
Malware in scrapy-user-agents
1 compromised version
- Jun 10, 2025
Malicious code in scikeras (npm)
1 compromised version
- Jun 10, 2025
Malware in scikeras
1 compromised version
- Jun 10, 2025
Malicious code in sails-mongo-ng (npm)
1 compromised version
- Jun 10, 2025
Malware in sails-mongo-ng
1 compromised version
- Jun 10, 2025
Malicious code in rlang (npm)
1 compromised version
- Jun 10, 2025
Malware in rlang
1 compromised version
- Jun 10, 2025
Malicious code in react-query-persist (npm)
1 compromised version
- Jun 10, 2025
Malware in react-query-persist
1 compromised version
- Jun 10, 2025
Malicious code in react-native-atob (npm)
1 compromised version
- Jun 10, 2025
Malware in react-native-atob
1 compromised version
- Jun 10, 2025
Malicious code in pyserial (npm)
1 compromised version
- Jun 10, 2025
Malware in pyserial
1 compromised version
- Jun 10, 2025
Malicious code in pyiceberg (npm)
1 compromised version
- Jun 10, 2025
Malware in pyiceberg
1 compromised version
- Jun 10, 2025
Malicious code in pydantic (npm)
1 compromised version
- Jun 10, 2025
Malware in pydantic
1 compromised version
- Jun 10, 2025
Malicious code in playwright-coverage (npm)
1 compromised version
- Jun 10, 2025
Malware in playwright-coverage
1 compromised version
- Jun 10, 2025
Malicious code in pipreqs (npm)
1 compromised version
- Jun 10, 2025
Malware in pipreqs
1 compromised version
- Jun 10, 2025
Malicious code in opt-einsum (npm)
1 compromised version
- Jun 10, 2025
Malware in opt-einsum
1 compromised version
- Jun 10, 2025
Malicious code in openssl-pkcs11 (npm)
1 compromised version
- Jun 10, 2025
Malware in openssl-pkcs11
1 compromised version
- Jun 10, 2025
Malicious code in ohhttpstubs (npm)
1 compromised version
- Jun 10, 2025
Malware in ohhttpstubs
1 compromised version
- Jun 10, 2025
Malicious code in office-addin-debugger (npm)
1 compromised version
- Jun 10, 2025
Malware in office-addin-debugger
1 compromised version
- Jun 10, 2025
Malicious code in react-logs (npm)
- Jun 10, 2025
Malicious code in node-loggers (npm)
- Jun 10, 2025
Malware in node-loggers
1 compromised version
- Jun 10, 2025
Malware in react-logs
1 compromised version
- Jun 10, 2025
Malicious code in networkx (npm)
1 compromised version
- Jun 10, 2025
Malware in networkx
1 compromised version
- Jun 10, 2025
Malicious code in ncftp (npm)
1 compromised version
- Jun 10, 2025
Malware in ncftp
1 compromised version
Page 6287 of 7,293