Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- May 30, 2025
Malware in morrrisjs
1 compromised version
- May 30, 2025
Malicious code in safe-query-buffer (npm)
- May 30, 2025
Malware in safe-query-buffer
1 compromised version
- May 30, 2025
Malicious code in http-parse (npm)
- May 30, 2025
Malware in http-parse
1 compromised version
- May 30, 2025
Malware in inter-frontend-hooks
1 compromised version
- May 30, 2025
Malware in inter-frontend-lib-util
1 compromised version
- May 30, 2025
Malware in cdpro-redux-utils
1 compromised version
- May 30, 2025
Malware in inter-dc-lib
1 compromised version
- May 30, 2025
Malicious code in nexpi-session (npm)
- May 30, 2025
Malware in nexpi-session
1 compromised version
- May 29, 2025
Malicious code in @mpsemea/fspay-smartpay-logging-web-sdk (npm)
1 compromised version
- May 29, 2025
Malicious code in discord-booster (PyPI)
9 compromised versions
- May 29, 2025
Malicious code in alpha-booster (PyPI)
4 compromised versions
- May 29, 2025
Malicious code in arc-offsec-custom-library2 (npm)
3 compromised versions
- May 29, 2025
Malware in reacts-gh
1 compromised version
- May 29, 2025
Malware in k8s-lint-action
1 compromised version
- May 29, 2025
Malware in nuget-trends
1 compromised version
- May 29, 2025
Malware in aspirejavascript-vite
1 compromised version
- May 29, 2025
Malware in html-report
1 compromised version
- May 29, 2025
Malware in typescript-go
1 compromised version
- May 29, 2025
Malware in qsc-workspace
1 compromised version
- May 29, 2025
Malware in react-native-xaml-repo
1 compromised version
- May 29, 2025
Malware in style-value-parser
1 compromised version
- May 29, 2025
Malicious code in rest-icon-provider (npm)
- May 29, 2025
Malware in rest-icon-provider
1 compromised version
- May 29, 2025
Malicious code in pancakeswap-oracle-prediction (npm)
- May 29, 2025
Malicious code in pancake_uniswap_validators_utils_snipe (npm)
- May 29, 2025
Malicious code in ethereum-smart-contract (npm)
- May 29, 2025
Malicious code in env-process (npm)
- May 29, 2025
Malware in pancakeswap-oracle-prediction
1 compromised version
- May 29, 2025
Malware in env-process
1 compromised version
- May 29, 2025
Malware in ethereum-smart-contract
1 compromised version
- May 29, 2025
Malware in pancake_uniswap_validators_utils_snipe
1 compromised version
- May 28, 2025
Malicious code in internal-lib-razor (npm)
1 compromised version
- May 28, 2025
Malicious code in xsolla-pay2play-widget (npm)
6 compromised versions
- May 28, 2025
Malicious code in csp-bypass-poc (npm)
- May 28, 2025
Malicious code in @hd-base/atoms (npm)
- May 28, 2025
Malicious code in halodoc (npm)
- May 28, 2025
Malware in blocks-nextjs
1 compromised version
- May 28, 2025
Malicious code in escapes (npm)
- May 28, 2025
Malware in escapes
1 compromised version
- May 28, 2025
Malicious code in rm-api-services (npm)
1 compromised version
- May 28, 2025
Malicious code in gitdependencyresource (npm)
2 compromised versions
- May 28, 2025
Malware in gitdependencyresource
1 compromised version
- May 28, 2025
Malware in hpglobaldata
1 compromised version
- May 28, 2025
Malware in ghpglobaldata
1 compromised version
- May 28, 2025
Malware in rm-api-services
1 compromised version
- May 28, 2025
Malicious code in wallet-connector-rce (npm)
4 compromised versions
- May 28, 2025
Malware in elysium-checkout
1 compromised version
Page 6296 of 7,293