Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- May 14, 2025
Malicious code in node-method-indicator (npm)
- May 14, 2025
Malicious code in node-event-listener (npm)
- May 14, 2025
Malicious code in next-auths (npm)
- May 14, 2025
Malicious code in next-auth-core (npm)
- May 14, 2025
Malicious code in mongoose-mongodb (npm)
- May 14, 2025
Malware in next-auth-core
1 compromised version
- May 14, 2025
Malware in next-auths
1 compromised version
- May 14, 2025
Malware in mongoose-mongodb
1 compromised version
- May 14, 2025
Malware in node-method-indicator
1 compromised version
- May 14, 2025
Malware in node-event-listener
1 compromised version
- May 14, 2025
Malicious code in vite-tsconfig-log (npm)
11 compromised versions
- May 14, 2025
Malicious code in middy-js (npm)
7 compromised versions
- May 14, 2025
Malware in middy-js
1 compromised version
- May 14, 2025
Malware in vite-tsconfig-log
1 compromised version
- May 14, 2025
Malicious code in consolidate-logging (npm)
1 compromised version
- May 14, 2025
Malware in consolidate-logging
1 compromised version
- May 14, 2025
Malicious code in next-logging-patcher (npm)
- May 14, 2025
Malware in next-logging-patcher
1 compromised version
- May 14, 2025
Malicious code in aiide-cur (npm)
- May 14, 2025
Malware in aiide-cur
1 compromised version
- May 13, 2025
Malicious code in gltfvariantmeld (npm)
- May 13, 2025
Malicious code in defi-wallet (npm)
2 compromised versions
- May 13, 2025
Malicious code in dep-b (npm)
- May 13, 2025
Malicious code in firefox-devtools (npm)
1 compromised version
- May 13, 2025
Malicious code in mockman-js-plugin (npm)
3 compromised versions
- May 13, 2025
Malware in mockman-js-plugin
1 compromised version
- May 13, 2025
Malicious code in sw-cur1 (npm)
- May 13, 2025
Malicious code in sw-cur (npm)
- May 13, 2025
Malware in sw-cur
1 compromised version
- May 13, 2025
Malware in sw-cur1
1 compromised version
- May 12, 2025
Malicious code in discorddox (PyPI)
2 compromised versions
- May 12, 2025
Malicious code in telegramdoxing (PyPI)
1 compromised version
- May 12, 2025
Malicious code in frau-hoster (npm)
- May 12, 2025
Malicious code in @skip-partner/i18n (npm)
- May 12, 2025
Malicious code in odin-backoffice-starter-kit (npm)
5 compromised versions
- May 12, 2025
Malicious code in @myop/vue-remote (npm)
- May 12, 2025
Malicious code in @myop/vue (npm)
- May 12, 2025
Malicious code in @myop/react-remote (npm)
- May 12, 2025
Malicious code in @myop/react (npm)
- May 12, 2025
Malicious code in @myop/n (npm)
- May 12, 2025
Malicious code in @myop/cli (npm)
- May 12, 2025
Malicious code in @myop/angular-remote (npm)
- May 12, 2025
Malicious code in @myop/angular (npm)
- May 12, 2025
Withdrawn Advisory: Malware in @myop/vue-remote
1 compromised version
- May 12, 2025
Withdrawn Advisory: Malware in @myop/cli
1 compromised version
- May 12, 2025
Withdrawn Advisory: Malware in @myop/react-remote
1 compromised version
- May 12, 2025
Malware in @myop/n
1 compromised version
- May 12, 2025
Withdrawn Advisory: Malware in @myop/vue
1 compromised version
- May 12, 2025
Withdrawn Advisory: Malware in @myop/angular-remote
1 compromised version
- May 12, 2025
Withdrawn Advisory: Malware in @myop/angular
1 compromised version
Page 6325 of 7,293