Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,565 total · sorted newest first- Sep 22, 2026
Malicious code in @egencia/uitk-react (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @egencia/uitk-global-styles-6 (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @egencia/uitk-global-styles (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @egencia/design-tokens (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/utils (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/ui-business (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/ui (npm)
2 compromised versions
- Sep 22, 2026
Malicious code in @client-web-next/ua-parser (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/transfer-state (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/timer (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/tarjeta-button (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/providers (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/origination-microfront (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/navigation-link (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/logger (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/icons (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/footer (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/feature-flags (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/event-bus-listener (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/env-util (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/cms (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/api-metrics (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/analytics (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/adaptive (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/ab-tests (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @client-web-next/ab-landing-form (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @cartradetech/example-package (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @adominadmininstr/fmt-date-helper (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @adominadmininstr/date-util-helper (npm)
1 compromised version
- Sep 22, 2026
Malicious code in mega-clean-box (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in burndler (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in burndlef (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in burmdler (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in buosndler (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in buonlder (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in buondler (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in buondlef (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in buomdler (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in buolder (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in buodler (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in buodlef (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in bunxuer (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in bunxlser (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in bunxlre (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in bunxloer (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in bunxlner (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in bunxlir (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in bunxlers (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in bunxlerr (RubyGems)
1 compromised version
- Sep 22, 2026
Malicious code in bunxlerl (RubyGems)
1 compromised version
Page 77 of 7,312