Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,981 total · sorted newest first- Jun 26, 2026
Malicious code in pump-laserstream-parser (npm)
1 compromised version
- Jun 26, 2026
Malicious code in pino-zod (npm)
2 compromised versions
- Jun 26, 2026
Malicious code in hydanlabs (npm)
4 compromised versions
- Jun 26, 2026
Malicious code in openblox (PyPI)
2 compromised versions
- Jun 26, 2026
Malicious code in js-price-client-node (npm)
1 compromised version
- Jun 26, 2026
Malicious code in js-client-node (npm)
1 compromised version
- Jun 26, 2026
Malicious code in dttfdsdee (npm)
7 compromised versions
- Jun 26, 2026
Malicious code in chai-as-synced (npm)
1 compromised version
- Jun 26, 2026
Malicious code in set-cookie-ease (npm)
1 compromised version
- Jun 26, 2026
Malicious code in mongoose-json-format (npm)
2 compromised versions
- Jun 26, 2026
Malicious code in @dervix/ws (npm)
6 compromised versions
- Jun 26, 2026
Malicious code in wellnpm (npm)
6 compromised versions
- Jun 26, 2026
Malicious code in animatecss-postcss-plugin (npm)
2 compromised versions
- Jun 26, 2026
Malicious code in @help-forms/application-aff (npm)
1 compromised version
- Jun 26, 2026
Malicious code in data-parser-utils (npm)
1 compromised version
- Jun 26, 2026
Malicious code in prism-silq (npm)
1 compromised version
- Jun 26, 2026
Malicious code in hexo-shoka-swiper (npm)
1 compromised version
- Jun 26, 2026
Malicious code in hexo-deployer-wrangler (npm)
1 compromised version
- Jun 25, 2026
Malicious code in random-string-64 (npm)
2 compromised versions
- Jun 25, 2026
Malicious code in extra-huggingface (PyPI)
1 compromised version
- Jun 25, 2026
Malicious code in pyext6cc8cd (PyPI)
1 compromised version
- Jun 25, 2026
Malicious code in kelly-stake (npm)
5 compromised versions
- Jun 25, 2026
Malicious code in gx-npm-lib (npm)
1 compromised version
- Jun 25, 2026
Malicious code in gx-npm-ui (npm)
1 compromised version
- Jun 25, 2026
Malicious code in velocityfix (npm)
5 compromised versions
- Jun 25, 2026
Malicious code in log-update-ts (npm)
1 compromised version
- Jun 25, 2026
Malicious code in @salem_jalal/osc-components (npm)
1 compromised version
- Jun 25, 2026
Malicious code in unsafe-malicious-package (npm)
8 compromised versions
- Jun 25, 2026
Malicious code in starship-timeline (npm)
1 compromised version
- Jun 25, 2026
Malicious code in runtimekit (npm)
2 compromised versions
- Jun 25, 2026
Malicious code in mi-test-99-tuapellido (PyPI)
1 compromised version
- Jun 25, 2026
Malicious code in ref-slot (npm)
1 compromised version
- Jun 25, 2026
Malicious code in typedecode (npm)
3 compromised versions
- Jun 25, 2026
Malicious code in textshape-css (npm)
1 compromised version
- Jun 25, 2026
Malicious code in colorpicker-ui (npm)
2 compromised versions
- Jun 25, 2026
Malicious code in tailwind-color-shades (npm)
1 compromised version
- Jun 25, 2026
Malicious code in tailwindcss-effector (npm)
1 compromised version
- Jun 25, 2026
Malicious code in chlklib (npm)
4 compromised versions
- Jun 25, 2026
Malicious code in ts-precision (npm)
1 compromised version
- Jun 25, 2026
Malicious code in ts-opus (npm)
1 compromised version
- Jun 25, 2026
Malicious code in @vpms/design-system (npm)
4 compromised versions
- Jun 25, 2026
Malicious code in chai-as-built (npm)
1 compromised version
- Jun 25, 2026
Malicious code in gx-npm-feature-flags (npm)
1 compromised version
- Jun 25, 2026
Malicious code in @colibri-event-types/megamarket-ru-web (npm)
1 compromised version
- Jun 25, 2026
Malicious code in abu-common-components (npm)
1 compromised version
- Jun 25, 2026
Malicious code in gpsea (PyPI)
1 compromised version
- Jun 25, 2026
Malicious code in embiggen (PyPI)
1 compromised version
- Jun 25, 2026
Malicious code in dttsdee (npm)
1 compromised version
- Jun 25, 2026
Malicious code in easy-string-kit232 (npm)
1 compromised version
- Jun 25, 2026
Malicious code in dddooo (npm)
3 compromised versions
Page 87 of 5,120