Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,987 total · sorted newest first- Jun 23, 2026
Malicious code in mjs-eslint-service (npm)
1 compromised version
- Jun 23, 2026
Malicious code in ts-sudo (npm)
1 compromised version
- Jun 23, 2026
Malicious code in parket-flow (npm)
1 compromised version
- Jun 23, 2026
Malicious code in ts-predict-helper (npm)
2 compromised versions
- Jun 23, 2026
Malicious code in ts-arithmetic-helper (npm)
1 compromised version
- Jun 23, 2026
Malicious code in chalk-ultra (npm)
3 compromised versions
- Jun 23, 2026
Malicious code in analysis-chart (npm)
21 compromised versions
- Jun 23, 2026
Malicious code in hashd-edu (npm)
5 compromised versions
- Jun 23, 2026
Malicious code in date-format-helper2 (npm)
7 compromised versions
- Jun 23, 2026
Malicious code in react-simple-utils-kit (npm)
18 compromised versions
- Jun 23, 2026
Malicious code in @outmarket/utils (npm)
3 compromised versions
- Jun 23, 2026
Malicious code in @outmarket/ui (npm)
1 compromised version
- Jun 23, 2026
Malicious code in airbnb-airlock (npm)
1 compromised version
- Jun 23, 2026
Malicious code in ttal2ttml (npm)
4 compromised versions
- Jun 23, 2026
Malicious code in kdrive-utils (npm)
1 compromised version
- Jun 23, 2026
Malicious code in cue-mcp (npm)
1 compromised version
- Jun 23, 2026
Malicious code in tree-sitter-forth (npm)
1 compromised version
- Jun 23, 2026
Malicious code in myebaynode (npm)
1 compromised version
- Jun 23, 2026
Malicious code in poly-utils (npm)
1 compromised version
- Jun 23, 2026
Malicious code in new-solt-1 (npm)
1 compromised version
- Jun 23, 2026
Malicious code in new-solt (npm)
3 compromised versions
- Jun 23, 2026
Malicious code in new-helper (npm)
1 compromised version
- Jun 23, 2026
Malicious code in new-ecro-helper (npm)
1 compromised version
- Jun 23, 2026
Malicious code in toorc (PyPI)
1 compromised version
- Jun 23, 2026
Malicious code in equest (PyPI)
1 compromised version
- Jun 23, 2026
Malicious code in ts-numbering (npm)
1 compromised version
- Jun 23, 2026
Malicious code in local-ip-helper (npm)
1 compromised version
- Jun 23, 2026
Malicious code in libsignal-node-travatiger (npm)
2 compromised versions
- Jun 23, 2026
Malicious code in ip-rotat (PyPI)
1 compromised version
- Jun 23, 2026
Malicious code in ts-wross (npm)
2 compromised versions
- Jun 23, 2026
Malicious code in node-core-libs (npm)
2 compromised versions
- Jun 23, 2026
Malicious code in search-from-search (npm)
1 compromised version
- Jun 23, 2026
Malicious code in @ts-apis/ts-utils (npm)
7 compromised versions
- Jun 22, 2026
Malicious code in web3-token-helper (npm)
8 compromised versions
- Jun 22, 2026
Malicious code in zod-pino (npm)
6 compromised versions
- Jun 22, 2026
Malicious code in @variational/common-ui (npm)
14 compromised versions
- Jun 22, 2026
Malicious code in node-fetch-utils (npm)
9 compromised versions
- Jun 22, 2026
Malicious code in vitest-cli (npm)
5 compromised versions
- Jun 22, 2026
Malicious code in zomato-mcp (npm)
1 compromised version
- Jun 22, 2026
Malicious code in zomato-espresso (npm)
1 compromised version
- Jun 22, 2026
Malicious code in zomato-core (npm)
1 compromised version
- Jun 22, 2026
Malicious code in sn-internal-testjgsakjdkjadkjah (npm)
5 compromised versions
- Jun 22, 2026
Malicious code in test-package-sajsdkashdj (npm)
2 compromised versions
- Jun 22, 2026
Malicious code in search-from-feed (npm)
1 compromised version
- Jun 22, 2026
Malicious code in gd-auth-client (npm)
1 compromised version
- Jun 22, 2026
Malicious code in @zynkit/jwtbytes (npm)
5 compromised versions
- Jun 22, 2026
Malicious code in @tinyfox/shapecheck (npm)
5 compromised versions
- Jun 22, 2026
Malicious code in @thymelab/logfx (npm)
4 compromised versions
- Jun 22, 2026
Malicious code in @petitcode/eb-retry (npm)
4 compromised versions
- Jun 22, 2026
Malicious code in @nullzero/urlcat (npm)
6 compromised versions
Page 91 of 5,120