Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,336 total · sorted newest first- Nov 2, 2026
Malicious code in unjailed (npm)
- Nov 2, 2026
Malicious code in tailwind-animate-test (npm)
- Nov 2, 2026
Malware in tailwind-animate-test
1 compromised version
- Nov 2, 2026
Malware in unjailed
1 compromised version
- Nov 2, 2026
Malicious code in @mrlegendbot/libsignal-node (npm)
- Nov 2, 2026
Malware in @mrlegendbot/libsignal-node
1 compromised version
- Nov 2, 2026
Malware in @mrlegendbot/baileys
1 compromised version
- Nov 2, 2026
Malware in wallet-adapter-base
1 compromised version
- Nov 2, 2026
Malicious code in @bigdevin55/calculator-install-demo (npm)
- Nov 2, 2026
Malware in contracts-upgradeable
1 compromised version
- Nov 2, 2026
Malware in calculator-preinstall-chain-demo
1 compromised version
- Nov 2, 2026
Malware in @bigdevin55/calculator-install-demo
1 compromised version
- Nov 2, 2026
Malware in axelarjs-sdk
1 compromised version
- Nov 2, 2026
Malware in sol-wallet-adapter
1 compromised version
- Nov 2, 2026
Malicious code in @bigdevin55/calculator-install-hook (npm)
- Nov 2, 2026
Malware in @bigdevin55/calculator-install-hook
1 compromised version
- Nov 2, 2026
Malware in calculator-preinstall-hook-demo
1 compromised version
- Nov 2, 2026
Malicious code in @nuxzofficial/baileys (npm)
- Nov 2, 2026
Malware in @nuxzofficial/baileys
1 compromised version
- Nov 2, 2026
Malicious code in nuxzofficial (npm)
- Nov 2, 2026
Malware in nuxzofficial
1 compromised version
- Nov 2, 2026
Malicious code in tailwindcss-animate-bridge (npm)
- Nov 2, 2026
Malicious code in @utilitycraft/tailwindcss-motion-atelier (npm)
- Nov 2, 2026
Malware in @utilitycraft/tailwindcss-motion-atelier
1 compromised version
- Nov 2, 2026
Malware in tailwindcss-animate-bridge
1 compromised version
- Nov 2, 2026
Malicious code in @ubedsockets/baileys (npm)
26 compromised versions
- Nov 2, 2026
Malicious code in atlassian-wallboard-plugin1 (npm)
- Nov 2, 2026
Malware in atlassian-wallboard-plugin1
1 compromised version
- Nov 2, 2026
Malware in claims-ac1
1 compromised version
- Nov 2, 2026
Malware in atlassian-wallboard-plugin
1 compromised version
- Nov 2, 2026
Malicious code in shoaib-unity (RubyGems)
1 compromised version
- Nov 2, 2026
Malicious code in intercom-react-native-example-e2e-tests (RubyGems)
1 compromised version
- Nov 2, 2026
Malicious code in persona-ai-sdk (npm)
1 compromised version
- Nov 2, 2026
Malware in persona-ai-sdk
1 compromised version
- Nov 2, 2026
Malicious code in intercom-react-native-example-e2e-tests (RubyGems)
1 compromised version
- Nov 2, 2026
Malicious code in shoaib-unity (RubyGems)
1 compromised version
- Nov 2, 2026
Malicious code in xenacious_kangaroo_blush-47 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in valid_antlion_amber-50 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in unfortunate_crawdad_emerald-79 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in temporary_smelt_lavender-81 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in specific_sheep_violet-22 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in southern_duck_tan-16 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in sound_deer_apricot-15 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in smooth_angelfish_emerald-54 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in pure_opossum_amaranth-54 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in motionless_mandrill_blush-51 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in itchy_gecko_magenta-98 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in intimate_ostrich_amethyst-45 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in inadequate_earwig_magenta-66 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in hushed_zebra_green-81 (npm)
1 compromised version
Page 8 of 7,307