Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,565 total · sorted newest first- Sep 23, 2026
Malicious code in solo-async-pipe (npm)
- Sep 23, 2026
Malicious code in semver-bump-io (npm)
- Sep 23, 2026
Malicious code in iso-datetime-core (npm)
- Sep 23, 2026
Malicious code in debounce-throttle-base (npm)
- Sep 23, 2026
Malware in semver-bump-io
1 compromised version
- Sep 23, 2026
Malware in solo-async-pipe
1 compromised version
- Sep 23, 2026
Malware in webp-https-errors
1 compromised version
- Sep 23, 2026
Malware in debounce-throttle-base
1 compromised version
- Sep 23, 2026
Malware in iso-datetime-core
1 compromised version
- Sep 23, 2026
Malware in prettier-lint-lenz
1 compromised version
- Sep 23, 2026
Malicious code in moudeva (npm)
1 compromised version
- Sep 23, 2026
Malicious code in moidevl (npm)
1 compromised version
- Sep 23, 2026
Malicious code in xsjukcnv8low26 (npm)
2 compromised versions
- Sep 23, 2026
Malicious code in tuxcmdfhjkw (npm)
1 compromised version
- Sep 23, 2026
Malicious code in tibcwmpoeafh (npm)
1 compromised version
- Sep 23, 2026
Malicious code in tib2jcvowuyma (npm)
1 compromised version
- Sep 23, 2026
Malicious code in mob4zchvuine (npm)
1 compromised version
- Sep 23, 2026
Malicious code in luftzxyuiwgbgsp (npm)
2 compromised versions
- Sep 23, 2026
Malicious code in kamafhbnowct (npm)
2 compromised versions
- Sep 23, 2026
Malicious code in caphsmgiwy (npm)
2 compromised versions
- Sep 23, 2026
Malware in vxhjkseuiaqkb
1 compromised version
- Sep 23, 2026
Malware in testdgdbcsd
1 compromised version
- Sep 23, 2026
Malware in tibcwmpoeafh
1 compromised version
- Sep 23, 2026
Malware in mn4xcouzvhus
1 compromised version
- Sep 23, 2026
Malware in mobiwaefhxc3
1 compromised version
- Sep 23, 2026
Malware in kamafhbnowct
1 compromised version
- Sep 23, 2026
Malware in tib2jcvowuyma
1 compromised version
- Sep 23, 2026
Malware in tesgfvbncsdbcv
1 compromised version
- Sep 23, 2026
Malware in mn2adskhweox
1 compromised version
- Sep 23, 2026
Malware in mjsdqwocvn
1 compromised version
- Sep 23, 2026
Malware in ndmxchdjxn2
1 compromised version
- Sep 23, 2026
Malware in mob4zchvuine
1 compromised version
- Sep 23, 2026
Malware in luftzxyuiwgbgsp
1 compromised version
- Sep 23, 2026
Malware in mndsxcusiwlk1
1 compromised version
- Sep 23, 2026
Malware in m3fdfocdoewn
1 compromised version
- Sep 23, 2026
Malware in m2fcsfyjkuxb
1 compromised version
- Sep 23, 2026
Malware in ndmfguyhoxc3
1 compromised version
- Sep 23, 2026
Malware in mn3sadkoiewu
1 compromised version
- Sep 23, 2026
Malware in xsjukcnv8low26
1 compromised version
- Sep 23, 2026
Malware in tuxcmdfhjkw
1 compromised version
- Sep 23, 2026
Malware in mbxcnsuwgs1
1 compromised version
- Sep 23, 2026
Malware in ndmushdkeqe
1 compromised version
- Sep 23, 2026
Malware in caphsmgiwy
1 compromised version
- Sep 23, 2026
Malware in skxcmwuncbg2
1 compromised version
- Sep 23, 2026
Malicious code in n8n-nodes-healthmon (npm)
1 compromised version
- Sep 23, 2026
Malicious code in n8n-nodes-metricsagent (npm)
1 compromised version
- Sep 23, 2026
Malicious code in my-company-device (npm)
2 compromised versions
- Sep 23, 2026
Malware in @usaa-grp-personal-profile/personal-profile-common
1 compromised version
- Sep 23, 2026
Malicious code in internallib_v550 (npm)
1 compromised version
- Sep 23, 2026
Malicious code in turbo-ws (npm)
1 compromised version
Page 73 of 7,312