Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,537 total · sorted newest first- Nov 3, 2026
Malware in k7nhgj
1 compromised version
- Nov 3, 2026
Malicious code in updated-gen-erator-carx-drift-racing-h-a-c-k-gen-erat-or-tkfm7v (npm)
- Nov 3, 2026
Malware in updated-gen-erator-carx-drift-racing-h-a-c-k-gen-erat-or-tkfm7v
1 compromised version
- Nov 3, 2026
Malicious code in @shein-risk/si_verify (npm)
- Nov 3, 2026
Malware in @shein-risk/si_verify
1 compromised version
- Nov 3, 2026
Malware in @systemzero/baileys
1 compromised version
- Nov 3, 2026
Malicious code in @vanzxy/nusa (npm)
- Nov 3, 2026
Malicious code in @vanzxy/baileys (npm)
- Nov 3, 2026
Malware in @vanzxy/baileys
1 compromised version
- Nov 3, 2026
Malware in @vanzxy/nusa
1 compromised version
- Nov 3, 2026
Malicious code in @lynnidoffc/libsignal-node (npm)
- Nov 3, 2026
Malicious code in @lynnidoffc/baileys (npm)
- Nov 3, 2026
Malware in @lynnidoffc/baileys
1 compromised version
- Nov 3, 2026
Malware in @lynnidoffc/libsignal-node
1 compromised version
- Nov 3, 2026
Malware in rootaccessxvv-bbmarker
1 compromised version
- Nov 3, 2026
Malicious code in nulio-connector (npm)
3 compromised versions
- Nov 3, 2026
Malware in nulio-connector
1 compromised version
- Nov 3, 2026
Malicious code in blitzstrike (npm)
1 compromised version
- Nov 3, 2026
Malware in blitzstrike
1 compromised version
- Nov 3, 2026
Malicious code in dsh-moss-wallpaper (npm)
1 compromised version
- Nov 3, 2026
Malware in dsh-moss-wallpaper
1 compromised version
- Nov 3, 2026
Malicious code in service-roles-registry (npm)
1 compromised version
- Nov 3, 2026
Malicious code in vibes-plug (npm)
1 compromised version
- Nov 3, 2026
Malware in vibes-plug
1 compromised version
- Nov 3, 2026
Malicious code in dsh-moss-console (npm)
1 compromised version
- Nov 3, 2026
Malware in dsh-moss-console
1 compromised version
- Nov 3, 2026
Malicious code in luna-baileys (npm)
8 compromised versions
- Nov 3, 2026
Malware in luna-baileys
1 compromised version
- Nov 3, 2026
Malicious code in @corexium/xbails (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/payment (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/settings (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/i18n (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/franchise-marketing (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/promotion (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/order (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/loyalty (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/franchise-directory (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/franchise-menu-settings (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/menu (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/homepages (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/store (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/franchise-management (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @atedone/workspace-context (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/marketing (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/combos (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/analytics (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/auth (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/app (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard/category (npm)
1 compromised version
- Nov 3, 2026
Malicious code in @goparrot-dashboard-api/users (npm)
1 compromised version
Page 9 of 7,311