Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,987 total · sorted newest first- Jun 18, 2026
Malicious code in @httpactions/encode-url (npm)
2 compromised versions
- Jun 18, 2026
Malicious code in randpicker (PyPI)
1 compromised version
- Jun 18, 2026
Malicious code in @gbrlxvi/ts-project-lint (npm)
1 compromised version
- Jun 18, 2026
Malicious code in react-error-lint (npm)
1 compromised version
- Jun 18, 2026
Malicious code in ratelimitsucks (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in ratelimitsucks6 (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in abuden221 (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in abuden22 (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in abuden218 (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in panrouter-admin (npm)
1 compromised version
- Jun 18, 2026
Malicious code in panrouter (npm)
2 compromised versions
- Jun 18, 2026
Malicious code in @onum-releases/utils (npm)
2 compromised versions
- Jun 18, 2026
Malicious code in @onum-releases/shared-components (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in @onum-releases/ixel (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in @onum-releases/sdk (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in @onum-releases/auth (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in @onum-releases/api-client (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in @caspianph/storyteller (npm)
1 compromised version
- Jun 18, 2026
Malicious code in computerrock-babel-preset-react-app (npm)
1 compromised version
- Jun 18, 2026
Malicious code in metavu (npm)
2 compromised versions
- Jun 18, 2026
Malicious code in parket-helper (npm)
2 compromised versions
- Jun 18, 2026
Malware in parket-helper
1 compromised version
- Jun 18, 2026
Malware in parket-slot
1 compromised version
- Jun 18, 2026
Malicious code in final-poc-usa (RubyGems)
1 compromised version
- Jun 18, 2026
Malicious code in final-shoaib (RubyGems)
1 compromised version
- Jun 18, 2026
Malware in uidai_reusable_components
1 compromised version
- Jun 18, 2026
Malicious code in @rafaelsene01/agent-flow (npm)
17 compromised versions
- Jun 18, 2026
Malware in @rafaelsene01/agent-flow
1 compromised version
- Jun 18, 2026
Malicious code in stackus (npm)
1 compromised version
- Jun 18, 2026
Malicious code in jwtmode (npm)
1 compromised version
- Jun 18, 2026
Malicious code in requests-middleware (npm)
1 compromised version
- Jun 18, 2026
Malicious code in roblox-api-client (npm)
1 compromised version
- Jun 18, 2026
Malicious code in intquery (npm)
2 compromised versions
- Jun 18, 2026
Malware in intquery
1 compromised version
- Jun 18, 2026
Malicious code in oem-agentic-shared (npm)
1 compromised version
- Jun 18, 2026
Malicious code in datacamp-light (npm)
1 compromised version
- Jun 18, 2026
Malicious code in data-utils-bcf2 (npm)
1 compromised version
- Jun 18, 2026
Malicious code in stream-read-35cf (npm)
1 compromised version
- Jun 18, 2026
Malicious code in metrics-probe-88ad (npm)
- Jun 18, 2026
Malicious code in data-utils-d703 (npm)
1 compromised version
- Jun 18, 2026
Malicious code in type-check-816d (npm)
1 compromised version
- Jun 18, 2026
Malicious code in string-tools-be6c (npm)
1 compromised version
- Jun 18, 2026
Malicious code in metrics-probe-f256 (npm)
1 compromised version
- Jun 18, 2026
Malicious code in fmt-helpers-794b (npm)
1 compromised version
- Jun 18, 2026
Malicious code in color-utils-dee0 (npm)
1 compromised version
- Jun 18, 2026
Malware in metrics-probe-f256
1 compromised version
- Jun 18, 2026
Malware in metrics-probe-88ad
1 compromised version
- Jun 18, 2026
Malware in type-check-816d
1 compromised version
- Jun 18, 2026
Malware in color-utils-dee0
1 compromised version
- Jun 18, 2026
Malware in metrics-probe-77d4
1 compromised version
Page 94 of 5,120