Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,565 total · sorted newest first- Sep 22, 2026
Malicious code in @user-services/web-components (npm)
1 compromised version
- Sep 22, 2026
Malicious code in mxdriver (npm)
1 compromised version
- Sep 22, 2026
Malicious code in tlxbnhd (npm)
1 compromised version
- Sep 22, 2026
Malicious code in tldriver (npm)
1 compromised version
- Sep 22, 2026
Malicious code in mxdriver (npm)
2 compromised versions
- Sep 22, 2026
Malicious code in chai-logger (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @tesla-insurance/vinless-quote (npm)
1 compromised version
- Sep 22, 2026
Malicious code in @user-services/web-components (npm)
1 compromised version
- Sep 22, 2026
Malicious code in take-home-caller-id (npm)
1 compromised version
- Sep 22, 2026
Malicious code in cisco-github-simple (npm)
1 compromised version
- Sep 22, 2026
Malicious code in cloushaar-poc-exfil-91827 (PyPI)
1 compromised version
- Sep 22, 2026
Malicious code in cloushaar-poc-exfil-91827 (PyPI)
1 compromised version
- Sep 22, 2026
Malware in emoji-prints-fancy
1 compromised version
- Sep 22, 2026
Malicious code in test-react-app-out (npm)
1 compromised version
- Sep 22, 2026
Malicious code in test-react-app-in (npm)
1 compromised version
- Sep 22, 2026
Malware in test-react-app-in
1 compromised version
- Sep 22, 2026
Malware in test-react-app-out
1 compromised version
- Sep 22, 2026
Malware in transform-es2015-unicode-regex
1 compromised version
- Sep 22, 2026
Malware in de-morgan
1 compromised version
- Sep 22, 2026
Malicious code in test-react-app-way (npm)
1 compromised version
- Sep 22, 2026
Malware in test-react-app-way
1 compromised version
- Sep 22, 2026
Malicious code in @uol-afiliados/affiliated-config-lib (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @zig-design-system/react (npm)
1 compromised version
- Sep 21, 2026
Malware in @zig-design-system/react
1 compromised version
- Sep 21, 2026
Malware in react-context-form-tdsss
1 compromised version
- Sep 21, 2026
Malicious code in wos-library (npm)
2 compromised versions
- Sep 21, 2026
Malware in wos-library-ui
1 compromised version
- Sep 21, 2026
Malware in wos-library
1 compromised version
- Sep 21, 2026
Malware in @vitets/vite-ts
1 compromised version
- Sep 21, 2026
Malicious code in @vite-tab/tabui (npm)
1 compromised version
- Sep 21, 2026
Malware in @vite-tab/tabui
1 compromised version
- Sep 21, 2026
Malware in @vite-tab/tab
1 compromised version
- Sep 21, 2026
Malware in @vite-pro/vite-ui
1 compromised version
- Sep 21, 2026
Malware in @vite-mcp/vite-type
1 compromised version
- Sep 21, 2026
Malware in @vite-ts/vite-ui
1 compromised version
- Sep 21, 2026
Malicious code in @uh-platform/domain-widget (npm)
1 compromised version
- Sep 21, 2026
Malicious code in my-ctf-helper-script-9921 (npm)
1 compromised version
- Sep 21, 2026
Malicious code in bytepack-probe-a7x3 (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @uh-platform/cloud (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @uh-platform/nadaver2 (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @uh-platform/nadaver (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @uh-platform/webcard (npm)
1 compromised version
- Sep 21, 2026
Malicious code in pullgetsage (PyPI)
1 compromised version
- Sep 21, 2026
Malicious code in blue-string-formatter-utilss (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @uol-afiliados/affiliated-config-lib (npm)
1 compromised version
- Sep 21, 2026
Malicious code in math-universe (npm)
3 compromised versions
- Sep 21, 2026
Malware in math-universe
1 compromised version
- Sep 21, 2026
Malicious code in mathsbase (npm)
3 compromised versions
- Sep 21, 2026
Malware in mathsbase
1 compromised version
Page 90 of 7,312