Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,981 total · sorted newest first- Jul 3, 2026
Malicious code in schemavault (PyPI)
2 compromised versions
- Jul 3, 2026
Malicious code in confighub (PyPI)
2 compromised versions
- Jul 3, 2026
Malicious code in procwire (PyPI)
4 compromised versions
- Jul 3, 2026
Malicious code in ipa-user-collector (PyPI)
1 compromised version
- Jul 3, 2026
Malicious code in haproxy-config-client (PyPI)
1 compromised version
- Jul 3, 2026
Malicious code in debugcli (npm)
6 compromised versions
- Jul 3, 2026
Malicious code in web-api-node (npm)
- Jul 3, 2026
Malicious code in typescript-util-core (npm)
4 compromised versions
- Jul 3, 2026
Malicious code in ts-node-utils (npm)
3 compromised versions
- Jul 3, 2026
Malicious code in api-ts-utils (npm)
- Jul 3, 2026
Malicious code in api-node-utils (npm)
1 compromised version
- Jul 3, 2026
Malicious code in alder_morrgan (npm)
- Jul 3, 2026
Malicious code in @node-cloud/create (npm)
7 compromised versions
- Jul 3, 2026
Malicious code in @lodash-en/lodash-en (npm)
2 compromised versions
- Jul 3, 2026
Malicious code in decode-sdks (npm)
- Jul 3, 2026
Malicious code in @jacobtan/decode-sdk (npm)
1 compromised version
- Jul 2, 2026
Malicious code in epic-internal-tools (npm)
1 compromised version
- Jul 2, 2026
Malicious code in horde-python-client (PyPI)
1 compromised version
- Jul 2, 2026
Malicious code in epic-build-scripts (PyPI)
1 compromised version
- Jul 2, 2026
Malicious code in ue-python-tools (PyPI)
1 compromised version
- Jul 2, 2026
Malicious code in unreal-mladapter (PyPI)
1 compromised version
- Jul 2, 2026
Malicious code in ue-automation-scripts (npm)
1 compromised version
- Jul 2, 2026
Malicious code in robomerge (npm)
1 compromised version
- Jul 2, 2026
Malicious code in unreal-horde-dashboard (npm)
1 compromised version
- Jul 2, 2026
Malicious code in ue-jenkins-buildkite (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @checkrhq/adjudication-api-client (npm)
1 compromised version
- Jul 2, 2026
Malicious code in dt-validator (PyPI)
1 compromised version
- Jul 2, 2026
Malicious code in tailwind-animates (npm)
1 compromised version
- Jul 2, 2026
Malicious code in db-convertor (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @modhamanish/rn-mm-template (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/navbar (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/mychatspreloader (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/madvpopup (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/livestreampreviewpopup (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/infopopup (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/header (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/gotoauthpopup (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/footer (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/fingerprint (npm)
- Jul 2, 2026
Malicious code in @marketfront/fashiononboardingpopup (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/errorcounter (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/dynamicpageparams (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/digitalherobannercarousel (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/devtoolsloader (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/designsystemdevtool (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/customdealsfeed (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/commonecommerce (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/changefilter (npm)
- Jul 2, 2026
Malicious code in @marketfront/captchaservice (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/blenderdevtool (npm)
1 compromised version
Page 81 of 5,120