Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,565 total · sorted newest first- Sep 23, 2026
Malicious code in vite-dev-launcher (npm)
1 compromised version
- Sep 23, 2026
Malicious code in sea-baileys (npm)
1 compromised version
- Sep 23, 2026
Malicious code in sea-baileys (npm)
1 compromised version
- Sep 23, 2026
Malicious code in vite-dev-launcher (npm)
1 compromised version
- Sep 23, 2026
Malicious code in wurl_show_data (RubyGems)
1 compromised version
- Sep 23, 2026
Malicious code in helpersutils-dev-tools (npm)
1 compromised version
- Sep 23, 2026
Malicious code in godzz (npm)
1 compromised version
- Sep 23, 2026
Malicious code in hachutis (npm)
1 compromised version
- Sep 23, 2026
Malicious code in godzzz (npm)
1 compromised version
- Sep 23, 2026
Malicious code in godxxx (npm)
1 compromised version
- Sep 23, 2026
Malicious code in @test1230504/string-format-helper (npm)
- Sep 23, 2026
Malicious code in @test1230504/probe-7f3k2m-utils (npm)
- Sep 23, 2026
Malware in @test1230504/string-format-helper
1 compromised version
- Sep 23, 2026
Malware in @test1230504/probe-7f3k2m-utils
1 compromised version
- Sep 23, 2026
Malicious code in @test1230504/test-publish-verify (npm)
- Sep 23, 2026
Malware in @test1230504/test-publish-verify
1 compromised version
- Sep 23, 2026
Malicious code in z-deno-truth-ya1t4m (npm)
1 compromised version
- Sep 23, 2026
Malicious code in z-deno-truth-va499w (npm)
1 compromised version
- Sep 23, 2026
Malware in z-deno-truth-ya1t4m
1 compromised version
- Sep 23, 2026
Malware in z-deno-truth-va499w
1 compromised version
- Sep 23, 2026
Malicious code in z-deno-truth-bwhlsz (npm)
2 compromised versions
- Sep 23, 2026
Malware in z-deno-truth-bwhlsz
1 compromised version
- Sep 23, 2026
Malicious code in hachutis (npm)
2 compromised versions
- Sep 23, 2026
Malicious code in helpersutils-dev-tools (npm)
1 compromised version
- Sep 23, 2026
Malicious code in godxxx (npm)
1 compromised version
- Sep 23, 2026
Malicious code in godzz (npm)
1 compromised version
- Sep 23, 2026
Malicious code in godzzz (npm)
1 compromised version
- Sep 23, 2026
Malicious code in kerokwis (PyPI)
1 compromised version
- Sep 23, 2026
Malicious code in efhthrthrthregerht (npm)
1 compromised version
- Sep 23, 2026
Malicious code in internallib_v497 (npm)
1 compromised version
- Sep 23, 2026
Malicious code in @vitemirrorte/element-plus-vite-cli (npm)
1 compromised version
- Sep 23, 2026
Malicious code in eslint-plugin-i18n-shreddit (npm)
1 compromised version
- Sep 23, 2026
Malicious code in catqrcodeconverter (npm)
1 compromised version
- Sep 23, 2026
Malicious code in catplatebarcodeparser (npm)
1 compromised version
- Sep 23, 2026
Malicious code in turbo-ws (npm)
1 compromised version
- Sep 23, 2026
Malicious code in moidevl (npm)
1 compromised version
- Sep 23, 2026
Malicious code in internallib_v550 (npm)
1 compromised version
- Sep 23, 2026
Malicious code in my-company-device (npm)
1 compromised version
- Sep 23, 2026
Malicious code in n8n-nodes-healthmon (npm)
1 compromised version
- Sep 23, 2026
Malicious code in n8n-nodes-metricsagent (npm)
1 compromised version
- Sep 23, 2026
Malicious code in moudeva (npm)
1 compromised version
- Sep 23, 2026
Malicious code in some-tool-package (npm)
1 compromised version
- Sep 23, 2026
Malicious code in better-md (npm)
1 compromised version
- Sep 23, 2026
Malware in better-md
1 compromised version
- Sep 23, 2026
Malware in subapp-pkg-util
1 compromised version
- Sep 23, 2026
Malware in some-tool-package
1 compromised version
- Sep 23, 2026
Malware in uolcs-host-uol-anuncios-fe
1 compromised version
- Sep 23, 2026
Malware in chai-tracker
1 compromised version
- Sep 23, 2026
Malware in dbconnectify
1 compromised version
- Sep 23, 2026
Malicious code in webp-https-errors (npm)
Page 72 of 7,312