Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,565 total · sorted newest first- Sep 23, 2026
Malicious code in internallib_v497 (npm)
1 compromised version
- Sep 23, 2026
Malicious code in catplatebarcodeparser (npm)
1 compromised version
- Sep 23, 2026
Malicious code in catqrcodeconverter (npm)
1 compromised version
- Sep 23, 2026
Malicious code in eslint-plugin-i18n-shreddit (npm)
1 compromised version
- Sep 23, 2026
Malicious code in efhthrthrthregerht (npm)
1 compromised version
- Sep 23, 2026
Malicious code in @vitemirrorte/element-plus-vite-cli (npm)
1 compromised version
- Sep 23, 2026
Malware in bnpl-blocks-mobile-bnpl-floating-button
1 compromised version
- Sep 23, 2026
Malware in bigops-products-timeline
1 compromised version
- Sep 23, 2026
Malware in bnpl-blocks-atom-bnpl-search-input
1 compromised version
- Sep 23, 2026
Malware in bigops-auth-interceptor
1 compromised version
- Sep 23, 2026
Malware in devplatform-sdk
1 compromised version
- Sep 23, 2026
Malicious code in n8n-nodes-data-transformer-utils (npm)
1 compromised version
- Sep 23, 2026
Malicious code in @tvg-mar/storyblok-bridge (npm)
1 compromised version
- Sep 23, 2026
Malicious code in eslint-config-compact-utils (npm)
1 compromised version
- Sep 23, 2026
Malicious code in @tvg-mar/promos-context (npm)
1 compromised version
- Sep 23, 2026
Malicious code in @tvg-mar/utils (npm)
1 compromised version
- Sep 23, 2026
Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)
1 compromised version
- Sep 23, 2026
Malicious code in @tvg-mar/promos-gtm (npm)
1 compromised version
- Sep 23, 2026
Malicious code in kerokwis (RubyGems)
1 compromised version
- Sep 23, 2026
Malicious code in @gsutevil/hta-stage (npm)
1 compromised version
- Sep 23, 2026
Malware in agora402-payment-utils
1 compromised version
- Sep 23, 2026
Malicious code in @wizloft/harness-project (npm)
- Sep 23, 2026
Malicious code in @wizloft/harness-file-providers (npm)
- Sep 23, 2026
Malicious code in @wizloft/harness-commands (npm)
- Sep 23, 2026
Malicious code in @wizloft/harness-cli-adapter (npm)
- Sep 23, 2026
Malware in @wizloft/harness-project
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness-plugin-repository-files
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness-cli-adapter
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness-commands
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness-file-providers
1 compromised version
- Sep 23, 2026
Malicious code in @wizloft/harness-plugin-memory-context (npm)
- Sep 23, 2026
Malicious code in @wizloft/harness-plugin-file-memory (npm)
- Sep 23, 2026
Malicious code in @wizloft/harness-plugin-file-events (npm)
- Sep 23, 2026
Malicious code in @wizloft/harness-memory (npm)
- Sep 23, 2026
Malicious code in @wizloft/harness-evidence (npm)
- Sep 23, 2026
Malicious code in @wizloft/harness-authority (npm)
- Sep 23, 2026
Malware in @wizloft/harness-context
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness-plugin-memory-context
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness-evidence
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness-kernel
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness-authority
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness-validation
1 compromised version
- Sep 23, 2026
Malware in anhn-cli
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness-plugin-file-events
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness-plugin-file-memory
1 compromised version
- Sep 23, 2026
Malware in @wizloft/harness-memory
1 compromised version
- Sep 23, 2026
Malicious code in @httttt/mcp-npx-fetch-1 (npm)
- Sep 23, 2026
Malware in @httttt/mcp-npx-fetch-1
1 compromised version
- Sep 23, 2026
Malware in @httttt/mcp-demo
1 compromised version
Page 74 of 7,312