Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,565 total · sorted newest first- Sep 30, 2026
Malicious code in react-nodejs (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @rutxploit-sec/subsplash-canny (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @rutxploit-sec/waves-icons (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @chatunity/baileys (npm)
1 compromised version
- Sep 30, 2026
Malicious code in testosu888 (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @selfpentest/bin-confusion (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @rutxploit-sec/waves-button-poc (npm)
1 compromised version
- Sep 30, 2026
Malicious code in testosu8887 (npm)
1 compromised version
- Sep 30, 2026
Malicious code in @selfpentest/eslint-pentest-plugin (npm)
1 compromised version
- Sep 30, 2026
Malicious code in test-agency-assignment-01 (npm)
1 compromised version
- Sep 30, 2026
Malicious code in test-agency-assignment-02 (npm)
1 compromised version
- Sep 30, 2026
Malicious code in test-agency-assign (npm)
1 compromised version
- Sep 30, 2026
Malicious code in common-fs (npm)
1 compromised version
- Sep 30, 2026
Malicious code in fs-commons (npm)
1 compromised version
- Sep 30, 2026
Malicious code in future-scripts (npm)
2 compromised versions
- Sep 29, 2026
Malicious code in fs-commons (npm)
1 compromised version
- Sep 29, 2026
Malicious code in common-fs (npm)
1 compromised version
- Sep 29, 2026
Malicious code in test-agency-assignment-01 (npm)
1 compromised version
- Sep 29, 2026
Malicious code in test-agency-assignment-02 (npm)
1 compromised version
- Sep 29, 2026
Malicious code in test-agency-assign (npm)
1 compromised version
- Sep 29, 2026
Malicious code in testosu8887 (npm)
1 compromised version
- Sep 29, 2026
Malicious code in testosu888 (npm)
1 compromised version
- Sep 29, 2026
Malicious code in @selfpentest/eslint-pentest-plugin (npm)
1 compromised version
- Sep 29, 2026
Malicious code in @selfpentest/bin-confusion (npm)
2 compromised versions
- Sep 29, 2026
Malicious code in @rutxploit-sec/waves-icons (npm)
1 compromised version
- Sep 29, 2026
Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm)
1 compromised version
- Sep 29, 2026
Malicious code in @rutxploit-sec/subsplash-canny (npm)
1 compromised version
- Sep 29, 2026
Malicious code in @rutxploit-sec/waves-button-poc (npm)
3 compromised versions
- Sep 29, 2026
Malicious code in @chatunity/baileys (npm)
3 compromised versions
- Sep 29, 2026
Malicious code in queeuees (PyPI)
1 compromised version
- Sep 29, 2026
Malicious code in @akapaki/baileys (npm)
1 compromised version
- Sep 29, 2026
Malicious code in @akapaki/baileys (npm)
3 compromised versions
- Sep 29, 2026
Malicious code in queeuees (PyPI)
1 compromised version
- Sep 29, 2026
Malicious code in @hrmony/kit-4 (npm)
1 compromised version
- Sep 29, 2026
Malicious code in @hrmony/kit (npm)
1 compromised version
- Sep 29, 2026
Malicious code in @hrmony/kit-1 (npm)
1 compromised version
- Sep 29, 2026
Malicious code in fabric-loader-core (npm)
1 compromised version
- Sep 29, 2026
Malware in txs-lib-sdk
1 compromised version
- Sep 29, 2026
Malicious code in sk-lib-enc (npm)
1 compromised version
- Sep 29, 2026
Malware in sk-lib-enc
1 compromised version
- Sep 29, 2026
Malware in ts-rand-sdk
1 compromised version
- Sep 29, 2026
Malicious code in @xoxo-momo/kit (npm)
1 compromised version
- Sep 29, 2026
Malware in @xoxo-momo/kit
1 compromised version
- Sep 29, 2026
Malware in @hrmony/valuenet
1 compromised version
- Sep 29, 2026
Malicious code in @hrmony/hyper-json-builder (npm)
1 compromised version
- Sep 29, 2026
Malware in @hrmony/benefitverwaltung
1 compromised version
- Sep 29, 2026
Malware in @hrmony/pladddform-shared-infrastructure
1 compromised version
- Sep 29, 2026
Malware in @hrmony/lohndateien
1 compromised version
- Sep 29, 2026
Malware in @hrmony/pladddform-application
1 compromised version
Page 65 of 7,312