Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,565 total · sorted newest first- Sep 30, 2026
Malicious code in @nyzzpedia/baileys-new (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @noxleyss/baileys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @lendkzn/xntaabail (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @japofc/baileys (npm)
7 compromised versions
- Sep 30, 2026
Malicious code in @hanzofc/baileys (npm)
2 compromised versions
- Sep 30, 2026
Malicious code in reactjs-risk (npm)
6 compromised versions
- Sep 30, 2026
Malicious code in niksinnkatalapp (npm)
1 compromised version
- Sep 30, 2026
Malicious code in live-detection-dashboard (npm)
1 compromised version
- Sep 30, 2026
Malicious code in figma-to-apl (npm)
1 compromised version
- Sep 30, 2026
Malicious code in brioche-apl-dev-env (npm)
1 compromised version
- Sep 30, 2026
Malicious code in apl-rive-renderer (npm)
1 compromised version
- Sep 30, 2026
Malicious code in alexa-cybertron-team-code-review-agent (npm)
1 compromised version
- Sep 30, 2026
Malicious code in ai-workshop-radio-lambda (npm)
1 compromised version
- Sep 30, 2026
Malicious code in ai-workshop-radio-app (npm)
1 compromised version
- Sep 30, 2026
Malicious code in ai-workshop-maa15-radio (npm)
1 compromised version
- Sep 30, 2026
Malicious code in okra-cloud-cdk (npm)
1 compromised version
- Sep 30, 2026
Malicious code in cleanup-string (PyPI)
1 compromised version
- Sep 30, 2026
Malicious code in dotenv-preflight (npm)
1 compromised version
- Sep 30, 2026
Malicious code in contoso-login-sim-loader (npm)
1 compromised version
- Sep 30, 2026
Malicious code in chaienv (npm)
1 compromised version
- Sep 30, 2026
Malicious code in cdn-img-fetch (npm)
1 compromised version
- Sep 30, 2026
Malicious code in cortana-md-engine (npm)
1 compromised version
- Sep 30, 2026
Malicious code in runhelper (npm)
1 compromised version
- Sep 30, 2026
Malicious code in focaleys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @zeronexcode/baileys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in fca-raihan (npm)
1 compromised version
- Sep 30, 2026
Malicious code in exiouss (npm)
1 compromised version
- Sep 30, 2026
Malicious code in imgbundle (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @cat-gen/material (npm)
3 compromised versions
- Sep 30, 2026
Malicious code in @cat-gen/materia (npm)
1 compromised version
- Sep 30, 2026
Malware in @cat-gen/materia
1 compromised version
- Sep 30, 2026
Malware in @cat-gen/material
1 compromised version
- Sep 30, 2026
Malware in feed-widget-helper
1 compromised version
- Sep 30, 2026
Malware in building-build
1 compromised version
- Sep 30, 2026
Malware in analytics-widget
1 compromised version
- Sep 30, 2026
Malware in ragacateslikodi
1 compromised version
- Sep 30, 2026
Malicious code in @firelordzuka/pulse-poc (npm)
- Sep 30, 2026
Malware in @firelordzuka/pulse-poc
1 compromised version
- Sep 30, 2026
Malicious code in link-status-page (npm)
11 compromised versions
- Sep 30, 2026
Malicious code in link-age-great (npm)
- Sep 30, 2026
Malware in link-age-great
1 compromised version
- Sep 30, 2026
Malware in web-vitals-polyfill-core-v1
1 compromised version
- Sep 30, 2026
Malware in link-status-page
1 compromised version
- Sep 30, 2026
Malicious code in @redman89405/my-module (npm)
2 compromised versions
- Sep 30, 2026
Malware in @redman89405/my-module
1 compromised version
- Sep 30, 2026
Malware in @zaka13/thing
1 compromised version
- Sep 30, 2026
Malware in radio-player-theme
1 compromised version
- Sep 30, 2026
Malicious code in runhelper (npm)
1 compromised version
- Sep 30, 2026
Malicious code in iban-validator-js (npm)
- Sep 30, 2026
Malware in iban-validator-js
1 compromised version
Page 63 of 7,312