Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,565 total · sorted newest first- Sep 21, 2026
Malicious code in bytepack-probe-a7x3 (npm)
2 compromised versions
- Sep 21, 2026
Malicious code in mathmain (npm)
1 compromised version
- Sep 21, 2026
Malware in mathmain
1 compromised version
- Sep 21, 2026
Malicious code in blue-string-formatter-utilss (npm)
1 compromised version
- Sep 21, 2026
Malicious code in my-ctf-helper-script-9921 (npm)
1 compromised version
- Sep 21, 2026
Malicious code in pullgetsage (PyPI)
3 compromised versions
- Sep 21, 2026
Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @uh-platform/nadaver (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @uh-platform/domain-widget (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @uh-platform/webcard (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @uh-platform/cloud (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @uh-platform/nadaver2 (npm)
1 compromised version
- Sep 21, 2026
Malicious code in hardhat-devkit (npm)
1 compromised version
- Sep 21, 2026
Malicious code in bnppf-flag-icons (npm)
1 compromised version
- Sep 21, 2026
Malicious code in hardhat-base (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @woodpecker-web-shared/components (npm)
1 compromised version
- Sep 21, 2026
Malicious code in starlette-healthchecks (PyPI)
1 compromised version
- Sep 21, 2026
Malicious code in @insiderintelligence/componentlibrary (npm)
1 compromised version
- Sep 21, 2026
Malicious code in gemini-computer-use (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @baanx/abis (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @baanx/blockchain-config (npm)
1 compromised version
- Sep 21, 2026
Malicious code in gemini-computer-use (npm)
3 compromised versions
- Sep 21, 2026
Malicious code in @woodpecker-web-shared/components (npm)
3 compromised versions
- Sep 21, 2026
Malicious code in @baanx/blockchain-config (npm)
2 compromised versions
- Sep 21, 2026
Malicious code in @baanx/abis (npm)
2 compromised versions
- Sep 21, 2026
Malicious code in @insiderintelligence/componentlibrary (npm)
1 compromised version
- Sep 21, 2026
Malicious code in starlette-healthchecks (PyPI)
2 compromised versions
- Sep 21, 2026
Malicious code in bnppf-flag-icons (npm)
1 compromised version
- Sep 21, 2026
Malicious code in hardhat-base (npm)
2 compromised versions
- Sep 21, 2026
Malicious code in hardhat-devkit (npm)
2 compromised versions
- Sep 21, 2026
Malicious code in radio-player-theme (npm)
1 compromised version
- Sep 21, 2026
Malicious code in pf25262 (npm)
1 compromised version
- Sep 21, 2026
Malicious code in pflag29424 (npm)
1 compromised version
- Sep 21, 2026
Malicious code in my-cdn-script (npm)
1 compromised version
- Sep 21, 2026
Malicious code in pf25133 (npm)
1 compromised version
- Sep 21, 2026
Malicious code in keroeltopgg (npm)
1 compromised version
- Sep 21, 2026
Malicious code in pflag14570 (npm)
1 compromised version
- Sep 21, 2026
Malicious code in keroeltopkk (npm)
1 compromised version
- Sep 21, 2026
Malicious code in homestack-cheer (npm)
1 compromised version
- Sep 21, 2026
Malicious code in feed-widget-helper (npm)
1 compromised version
- Sep 21, 2026
Malicious code in pf23727 (npm)
1 compromised version
- Sep 21, 2026
Malicious code in chai-as-viem (npm)
1 compromised version
- Sep 21, 2026
Malicious code in commerce-materials (npm)
1 compromised version
- Sep 21, 2026
Malicious code in sorrawit-dev-helper (npm)
1 compromised version
- Sep 21, 2026
Malicious code in catwrestlinghuman (npm)
1 compromised version
- Sep 21, 2026
Malicious code in siriusbeyond (npm)
1 compromised version
- Sep 21, 2026
Malicious code in keroeltopkkk (npm)
1 compromised version
- Sep 21, 2026
Malicious code in catwrestlingbird (npm)
1 compromised version
- Sep 21, 2026
Malicious code in element-plus-vite-cli (npm)
1 compromised version
- Sep 21, 2026
Malicious code in @siriusbeyond/ui (npm)
1 compromised version
Page 91 of 7,312