Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,884 total · sorted newest first- Oct 26, 2026
Malicious code in zagents-framework (PyPI)
2 compromised versions
- Oct 26, 2026
Malicious code in changes-lxc-wrapper (PyPI)
2 compromised versions
- Oct 26, 2026
Malicious code in @worca/app (npm)
2 compromised versions
- Oct 26, 2026
Malware in @worca/app
1 compromised version
- Oct 26, 2026
Malicious code in publish-poc-base (npm)
1 compromised version
- Oct 26, 2026
Malicious code in publish-poc-test3 (npm)
7 compromised versions
- Oct 26, 2026
Malicious code in @walknpm/todo-cli (npm)
1 compromised version
- Oct 26, 2026
Malicious code in dsh-plugin-blender-3d (npm)
1 compromised version
- Oct 26, 2026
Malicious code in @apexacc/cli (npm)
4 compromised versions
- Oct 26, 2026
Malicious code in dictmerge-lite (PyPI)
1 compromised version
- Oct 26, 2026
Malicious code in @sxm-web/client-sdk-core (npm)
1 compromised version
- Oct 26, 2026
Malicious code in claudeopusenifile (PyPI)
1 compromised version
- Oct 26, 2026
Malicious code in claudeopuseni (PyPI)
1 compromised version
- Oct 26, 2026
Malicious code in @greenlake/context-pane (npm)
1 compromised version
- Oct 26, 2026
Malicious code in @greenlake/auth (npm)
1 compromised version
- Oct 26, 2026
Malicious code in @greenlake/mfe-login-url (npm)
1 compromised version
- Oct 26, 2026
Malicious code in numbors (npm)
1 compromised version
- Oct 26, 2026
Malware in numbors
1 compromised version
- Oct 26, 2026
Malicious code in dsh-native (npm)
1 compromised version
- Oct 26, 2026
Malware in dsh-native
1 compromised version
- Oct 26, 2026
Malicious code in bow-test (npm)
- Oct 26, 2026
Malware in bow-test
1 compromised version
- Oct 26, 2026
Malware in brass-common
1 compromised version
- Oct 26, 2026
Malicious code in css-hnhxwd-polyfill (npm)
- Oct 26, 2026
Malicious code in css-flexgap-shim (npm)
- Oct 26, 2026
Malicious code in util-foriepft (npm)
1 compromised version
- Oct 26, 2026
Malware in css-flexgap-shim
1 compromised version
- Oct 26, 2026
Malware in css-overscroll-contain
1 compromised version
- Oct 26, 2026
Malware in util-foriepft
1 compromised version
- Oct 26, 2026
Malware in css-hnhxwd-polyfill
1 compromised version
- Oct 26, 2026
Malicious code in css-grid-snap-util (npm)
2 compromised versions
- Oct 26, 2026
Malicious code in @regex33-hackerone/tb-compat (npm)
1 compromised version
- Oct 26, 2026
Malware in css-grid-snap-util
1 compromised version
- Oct 26, 2026
Malware in @regex33-hackerone/tb-compat
1 compromised version
- Oct 26, 2026
Malware in ap3-foundations-ui
1 compromised version
- Oct 26, 2026
Malware in react-dropzone-v4
1 compromised version
- Oct 26, 2026
Malware in orderly-plugin-liquidity-heatmap
1 compromised version
- Oct 26, 2026
Malicious code in @walknpm/todo-cli (npm)
1 compromised version
- Oct 26, 2026
Malicious code in dsh-plugin-blender-3d (npm)
1 compromised version
- Oct 26, 2026
Malicious code in claudeopusfile (PyPI)
1 compromised version
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/scan-https-dualuse-e (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/scan-echo-b (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/scan-dns-c (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/scan-control-a (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/r2-https-dualuse (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/r2-echo (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/r2-dns (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/r2-control (npm)
- Oct 26, 2026
Malware in @s4yhiitestpoc/scan-dns-c
1 compromised version
- Oct 26, 2026
Malware in @s4yhiitestpoc/r2-https-dualuse
1 compromised version
Page 7 of 7,298