Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,565 total · sorted newest first- Sep 30, 2026
Malware in jexkcode
1 compromised version
- Sep 30, 2026
Malware in get-power
1 compromised version
- Sep 30, 2026
Malicious code in focaleys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in fca-raihan (npm)
2 compromised versions
- Sep 30, 2026
Malicious code in exiouss (npm)
1 compromised version
- Sep 30, 2026
Malicious code in imgbundle (npm)
3 compromised versions
- Sep 30, 2026
Malicious code in contoso-login-sim-loader (npm)
1 compromised version
- Sep 30, 2026
Malicious code in cdn-img-fetch (npm)
3 compromised versions
- Sep 30, 2026
Malicious code in cleanup-string (PyPI)
1 compromised version
- Sep 30, 2026
Malicious code in cortana-md-engine (npm)
1 compromised version
- Sep 30, 2026
Malicious code in chaienv (npm)
1 compromised version
- Sep 30, 2026
Malicious code in fabric-loader-core (npm)
1 compromised version
- Sep 30, 2026
Malicious code in zeal-utils (npm)
1 compromised version
- Sep 30, 2026
Malicious code in tailwind-forms-kit (npm)
1 compromised version
- Sep 30, 2026
Malicious code in mfahelper (npm)
1 compromised version
- Sep 30, 2026
Malicious code in stestenv (npm)
1 compromised version
- Sep 30, 2026
Malicious code in fabric-mod-utils (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @larocas-bbresearch/tombstone-probe-live-z6xz56 (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @larocas-bbresearch/tp-probe-e29834ce (npm)
1 compromised version
- Sep 30, 2026
Malicious code in web-vitals-polyfill-core-v1 (npm)
1 compromised version
- Sep 30, 2026
Malicious code in dotenv-precheck (npm)
1 compromised version
- Sep 30, 2026
Malicious code in esm-dotenv (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @larocas-bbresearch/tombstone-probe-8ejnsa (npm)
1 compromised version
- Sep 30, 2026
Malicious code in solidity-lock (npm)
1 compromised version
- Sep 30, 2026
Malicious code in zeal-util-hooks (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @larocas-bbresearch/tombstone-probe-odvz5y (npm)
1 compromised version
- Sep 30, 2026
Malicious code in bfox-build-utils (PyPI)
1 compromised version
- Sep 30, 2026
Malicious code in booking-tasks (npm)
1 compromised version
- Sep 30, 2026
Malicious code in developmentstelemetry (npm)
1 compromised version
- Sep 30, 2026
Malicious code in itsmeeaizat-bailey (npm)
1 compromised version
- Sep 30, 2026
Malicious code in godsplan (npm)
1 compromised version
- Sep 30, 2026
Malicious code in booking-eligibility (npm)
1 compromised version
- Sep 30, 2026
Malicious code in json-bigint-rs (npm)
1 compromised version
- Sep 30, 2026
Malicious code in test-supply-npm-lib-4 (npm)
1 compromised version
- Sep 30, 2026
Malicious code in pixsvg (npm)
1 compromised version
- Sep 30, 2026
Malicious code in booking-eligibility (npm)
1 compromised version
- Sep 30, 2026
Malicious code in developmentstelemetry (npm)
2 compromised versions
- Sep 30, 2026
Malicious code in booking-tasks (npm)
1 compromised version
- Sep 30, 2026
Malicious code in bfox-build-utils (PyPI)
1 compromised version
- Sep 30, 2026
Malicious code in pixsvg (npm)
1 compromised version
- Sep 30, 2026
Malicious code in json-bigint-rs (npm)
1 compromised version
- Sep 30, 2026
Malicious code in test-supply-npm-lib-4 (npm)
4 compromised versions
- Sep 30, 2026
Malicious code in itsmeeaizat-bailey (npm)
3 compromised versions
- Sep 30, 2026
Malicious code in esm-dotenv (npm)
1 compromised version
- Sep 30, 2026
Malicious code in stestenv (npm)
1 compromised version
- Sep 30, 2026
Malicious code in tailwind-forms-kit (npm)
3 compromised versions
- Sep 30, 2026
Malicious code in fabric-mod-utils (npm)
1 compromised version
- Sep 30, 2026
Malicious code in mfahelper (npm)
1 compromised version
- Sep 30, 2026
Malicious code in solidity-lock (npm)
1 compromised version
- Sep 30, 2026
Malicious code in web-vitals-polyfill-core-v1 (npm)
1 compromised version
Page 64 of 7,312