Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- May 1, 2025
Malware in tree-sitter-hcl
1 compromised version
- May 1, 2025
Malware in tree-sitter-r
1 compromised version
- May 1, 2025
Malicious code in customprefix-auth (npm)
2 compromised versions
- May 1, 2025
Malicious code in rei-session (npm)
1 compromised version
- May 1, 2025
Malicious code in array-length-validator (npm)
9 compromised versions
- May 1, 2025
Malware in array-length-validator
1 compromised version
- May 1, 2025
Malicious code in mymte (npm)
- May 1, 2025
Malware in mymte
1 compromised version
- May 1, 2025
Malicious code in mymte2 (npm)
- May 1, 2025
Malicious code in expo-sessoion (npm)
- May 1, 2025
Malicious code in expi-session (npm)
10 compromised versions
- May 1, 2025
Malware in expo-sessoion
1 compromised version
- May 1, 2025
Malware in mymte2
1 compromised version
- May 1, 2025
Malware in expi-session
1 compromised version
- Apr 30, 2025
Malicious code in telepycore (PyPI)
9 compromised versions
- Apr 30, 2025
Malicious code in helmet-fastapi (PyPI)
5 compromised versions
- Apr 30, 2025
Malicious code in cxo-storyboard (npm)
11 compromised versions
- Apr 30, 2025
Malware in cxo-storyboard
1 compromised version
- Apr 30, 2025
Malware in @template-builder/iframe-api
1 compromised version
- Apr 30, 2025
Malicious code in express-validator-plugin (npm)
6 compromised versions
- Apr 30, 2025
Malware in express-validator-plugin
1 compromised version
- Apr 30, 2025
Malicious code in pie-docs (npm)
2 compromised versions
- Apr 30, 2025
Malicious code in managethis (npm)
1 compromised version
- Apr 30, 2025
Malware in managethis
1 compromised version
- Apr 30, 2025
Malicious code in unified-login-url (npm)
105 compromised versions
- Apr 30, 2025
Malicious code in ts-39-issue-ts-ignore-tsx (npm)
4 compromised versions
- Apr 30, 2025
Malware in unified-login-url
1 compromised version
- Apr 30, 2025
Malware in ts-39-issue-ts-ignore-tsx
1 compromised version
- Apr 30, 2025
Malicious code in easyship-components (npm)
55 compromised versions
- Apr 30, 2025
Malware in easyship-components
1 compromised version
- Apr 30, 2025
Malware in r5-wallet
1 compromised version
- Apr 30, 2025
Malicious code in passports-twitter (npm)
2 compromised versions
- Apr 30, 2025
Malware in passports-twitter
1 compromised version
- Apr 30, 2025
Malicious code in internal-payroll-lib-v3 (npm)
1 compromised version
- Apr 30, 2025
Malicious code in internal-payroll-lib-v2 (npm)
1 compromised version
- Apr 30, 2025
Malware in internal-payroll-lib-v3
1 compromised version
- Apr 30, 2025
Malware in internal-payroll-lib-v2
1 compromised version
- Apr 30, 2025
Malicious code in mcrodoasp.net (npm)
1 compromised version
- Apr 30, 2025
Malicious code in deals1flash (npm)
1 compromised version
- Apr 30, 2025
Malicious code in carcandofilex (npm)
1 compromised version
- Apr 30, 2025
Malicious code in basstiontrestbeesk (npm)
1 compromised version
- Apr 30, 2025
Malware in markdownalint-cli2
1 compromised version
- Apr 30, 2025
Malware in mcrodoasp.net
1 compromised version
- Apr 30, 2025
Malware in deals1flash
1 compromised version
- Apr 30, 2025
Malware in carcandofilex
1 compromised version
- Apr 30, 2025
Malware in basstiontrestbeesk
1 compromised version
- Apr 30, 2025
Malicious code in redmins (npm)
- Apr 30, 2025
Malware in reducal
1 compromised version
- Apr 30, 2025
Malware in redmins
1 compromised version
- Apr 30, 2025
Malicious code in blur-plugins (npm)
Page 6334 of 7,293