Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,981 total · sorted newest first- Jun 29, 2026
Malicious code in spateo-release (PyPI)
1 compromised version
- Jun 29, 2026
Malicious code in dynamo-release (PyPI)
1 compromised version
- Jun 29, 2026
Malicious code in authsessionbridge (npm)
1 compromised version
- Jun 29, 2026
Malicious code in authmatrix (npm)
2 compromised versions
- Jun 29, 2026
Malicious code in auth-state-service (npm)
1 compromised version
- Jun 29, 2026
Malicious code in vkzmn (npm)
9 compromised versions
- Jun 29, 2026
Malicious code in django-bkvision (PyPI)
1 compromised version
- Jun 29, 2026
Malicious code in maplibre-gl-vue3 (npm)
4 compromised versions
- Jun 29, 2026
Malicious code in endpointmap (npm)
2 compromised versions
- Jun 29, 2026
Malicious code in envfile-sync (npm)
1 compromised version
- Jun 29, 2026
Malicious code in envfile-sync-cli (npm)
3 compromised versions
- Jun 29, 2026
Malicious code in clob-client-math (npm)
2 compromised versions
- Jun 29, 2026
Malicious code in ledgerflow-deploy-utils (npm)
4 compromised versions
- Jun 29, 2026
Malicious code in loadutils (npm)
3 compromised versions
- Jun 29, 2026
Malicious code in layerd-unit-codec-parser (npm)
2 compromised versions
- Jun 29, 2026
Malicious code in pino-debugging (npm)
3 compromised versions
- Jun 29, 2026
Malicious code in openai-agents-helpers (npm)
25 compromised versions
- Jun 29, 2026
Malicious code in poly-kelly (npm)
5 compromised versions
- Jun 29, 2026
Malicious code in checkmarx-claude-cache (npm)
2 compromised versions
- Jun 29, 2026
Malicious code in ollama-helpers (npm)
23 compromised versions
- Jun 29, 2026
Malicious code in int_sezzle_sfra (npm)
1 compromised version
- Jun 29, 2026
Malicious code in stake-math (npm)
7 compromised versions
- Jun 29, 2026
Malicious code in lessload (npm)
1 compromised version
- Jun 29, 2026
Malicious code in yastatic-s3 (npm)
3 compromised versions
- Jun 29, 2026
Malicious code in @ibrahim1337/baksen (npm)
19 compromised versions
- Jun 29, 2026
Malicious code in @thone33/analytics-injector (npm)
2 compromised versions
- Jun 29, 2026
Malicious code in @thone33/core-utils (npm)
6 compromised versions
- Jun 29, 2026
Malicious code in longzy-basic-ui (npm)
1 compromised version
- Jun 29, 2026
Malicious code in pkg-fallback (npm)
1 compromised version
- Jun 29, 2026
Malicious code in express-mocha-test (npm)
1 compromised version
- Jun 29, 2026
Malicious code in @epic-common/observability-node (npm)
3 compromised versions
- Jun 29, 2026
Malicious code in yandex-geobase (npm)
6 compromised versions
- Jun 29, 2026
Malicious code in react-wp-viewer (npm)
3 compromised versions
- Jun 29, 2026
Malicious code in date-uuid (npm)
5 compromised versions
- Jun 29, 2026
Malicious code in eslint-commit-parser (npm)
1 compromised version
- Jun 29, 2026
Malicious code in @uisp/utils (npm)
3 compromised versions
- Jun 29, 2026
Malicious code in rebrandly-domains-digger (npm)
1 compromised version
- Jun 29, 2026
Malicious code in rebrandly-domains-search-client (npm)
1 compromised version
- Jun 29, 2026
Malicious code in ulid-xyz (npm)
9 compromised versions
- Jun 29, 2026
Malicious code in @sailing-package/core (npm)
- Jun 29, 2026
Malicious code in @longzy/react-native-polyfill (npm)
- Jun 29, 2026
Malicious code in @digitalcnzz/embedded-sdk (npm)
- Jun 29, 2026
Malicious code in @digitalcnzz/commonmodule (npm)
- Jun 28, 2026
Malicious code in skillspector (PyPI)
8 compromised versions
- Jun 28, 2026
Malicious code in tdata-grabber (PyPI)
1 compromised version
- Jun 28, 2026
Malicious code in lc-chatbot (npm)
1 compromised version
- Jun 28, 2026
Malicious code in fsociety-tools (PyPI)
3 compromised versions
- Jun 28, 2026
Malicious code in polymarket-clob-math (npm)
1 compromised version
- Jun 28, 2026
Malicious code in livekit-agents (npm)
10 compromised versions
- Jun 28, 2026
Malicious code in pkg-fallback (PyPI)
1 compromised version
Page 85 of 5,120