Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,987 total · sorted newest first- Jun 18, 2026
Malware in string-tools-be6c
1 compromised version
- Jun 18, 2026
Malware in metrics-probe-64b2
1 compromised version
- Jun 18, 2026
Malware in metrics-pipeline-d8k2
1 compromised version
- Jun 18, 2026
Malware in runtime-metrics-w7k2
1 compromised version
- Jun 18, 2026
Malware in data-utils-d703
1 compromised version
- Jun 18, 2026
Malware in fmt-helpers-794b
1 compromised version
- Jun 18, 2026
Malware in metrics-probe-dc85
1 compromised version
- Jun 18, 2026
Malicious code in npm-sandbox-research-f1g2 (npm)
- Jun 18, 2026
Malicious code in npm-sandbox-research-a1b2 (npm)
- Jun 18, 2026
Malicious code in @ncurran/sandbox-recon-uac-4e7c (npm)
- Jun 18, 2026
Malicious code in @ncurran/sandbox-recon-sys-6a3f (npm)
- Jun 18, 2026
Malicious code in @ncurran/sandbox-recon-sys-5f1b (npm)
- Jun 18, 2026
Malicious code in @ncurran/sandbox-recon-sys-5b2c (npm)
- Jun 18, 2026
Malicious code in @ncurran/sandbox-recon-9b2d4f (npm)
- Jun 18, 2026
Malicious code in @ncurran/sandbox-recon-880538 (npm)
- Jun 18, 2026
Malicious code in @ncurran/sandbox-recon-7c4e1a (npm)
- Jun 18, 2026
Malicious code in @ncurran/dc-selftest-ba0ad4 (npm)
- Jun 18, 2026
Malicious code in @ncurran/dc-selftest-33afb7 (npm)
- Jun 18, 2026
Malware in npm-sandbox-ping-c8f2a
1 compromised version
- Jun 18, 2026
Malware in @ncurran/dc-selftest-ba0ad4
1 compromised version
- Jun 18, 2026
Malware in @ncurran/sandbox-recon-sys-5f1b
1 compromised version
- Jun 18, 2026
Malware in npm-sandbox-research-9c4e
1 compromised version
- Jun 18, 2026
Malware in npm-sandbox-research-d7e8
1 compromised version
- Jun 18, 2026
Malware in npm-sandbox-research-8b2f
1 compromised version
- Jun 18, 2026
Malware in @ncurran/sandbox-recon-sys-5b2c
1 compromised version
- Jun 18, 2026
Malware in npm-sandbox-ping-r9t2
1 compromised version
- Jun 18, 2026
Malware in npm-sandbox-research-g3h4
1 compromised version
- Jun 18, 2026
Malware in npm-sandbox-research-a1b2
1 compromised version
- Jun 18, 2026
Malware in postinstall-logger-7x9z
1 compromised version
- Jun 18, 2026
Malware in @ncurran/sandbox-recon-9b2d4f
1 compromised version
- Jun 18, 2026
Malware in @ncurran/sandbox-recon-sys-6a3f
1 compromised version
- Jun 18, 2026
Malware in @ncurran/sandbox-recon-uac-4e7c
1 compromised version
- Jun 18, 2026
Malware in @ncurran/sandbox-recon-880538
1 compromised version
- Jun 18, 2026
Malware in npm-sandbox-research-e9f0
1 compromised version
- Jun 18, 2026
Malware in pkg-telemetry-r4f9
1 compromised version
- Jun 18, 2026
Malware in @ncurran/sandbox-recon-7c4e1a
1 compromised version
- Jun 18, 2026
Malware in npm-sandbox-research-f1g2
1 compromised version
- Jun 18, 2026
Malware in npm-sandbox-research-c5d6
1 compromised version
- Jun 18, 2026
Malware in @ncurran/dc-selftest-33afb7
1 compromised version
- Jun 17, 2026
Malicious code in vite-common-utils (npm)
3 compromised versions
- Jun 17, 2026
Malicious code in uol-simple-api-futebol (npm)
5 compromised versions
- Jun 17, 2026
Malicious code in ai-chat-helper (npm)
3 compromised versions
- Jun 17, 2026
Malicious code in @hotcappuccino/nodepull (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @array-util/nodepull (npm)
3 compromised versions
- Jun 17, 2026
Malicious code in pino-slite (npm)
2 compromised versions
- Jun 17, 2026
Malicious code in set-proto-chain (npm)
1 compromised version
- Jun 17, 2026
Malicious code in dotenv-sync (PyPI)
1 compromised version
- Jun 17, 2026
Malicious code in disksweep (PyPI)
1 compromised version
- Jun 17, 2026
Malicious code in ebpf-tracker-action (npm)
1 compromised version
- Jun 17, 2026
Malicious code in syncagents (PyPI)
2 compromised versions
Page 95 of 5,120