Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
242,593 total in npm · sorted newest first- Jun 20, 2022
Malware in spiferack
1 compromised version
- Jun 20, 2022
Malicious code in supplysec-alert (npm)
- Jun 20, 2022
Malicious code in piwik-pro-angular-tracking (npm)
- Jun 20, 2022
Malicious code in data-api.js-core (npm)
- Jun 20, 2022
Malicious code in colors-1.0 (npm)
- Jun 20, 2022
Malware in supplysec-alert
1 compromised version
- Jun 20, 2022
Malware in colors-1.0
1 compromised version
- Jun 20, 2022
Malware in piwik-pro-angular-tracking
1 compromised version
- Jun 20, 2022
Malware in data-api.js-core
1 compromised version
- Jun 20, 2022
Malicious code in snyk-resolve-dep (npm)
- Jun 20, 2022
Malicious code in snyk-azure-pipelines-task (npm)
- Jun 20, 2022
Malicious code in ffwebsite (npm)
- Jun 20, 2022
Malicious code in aoxqgmortgkgldq (npm)
- Jun 20, 2022
Malware in snyk-resolve-dep
1 compromised version
- Jun 20, 2022
Malware in snyk-azure-pipelines-task
1 compromised version
- Jun 20, 2022
Malware in aoxqgmortgkgldq
1 compromised version
- Jun 20, 2022
Malware in ffwebsite
1 compromised version
- Jun 20, 2022
Malicious code in touchright (npm)
- Jun 20, 2022
Malicious code in intentionally-malicious1 (npm)
- Jun 20, 2022
Malicious code in intentionally-malicious (npm)
- Jun 20, 2022
Malicious code in drwffjbwkwxsvyo (npm)
- Jun 20, 2022
Malware in intentionally-malicious1
1 compromised version
- Jun 20, 2022
Malware in touchright
1 compromised version
- Jun 20, 2022
Malware in drwffjbwkwxsvyo
1 compromised version
- Jun 20, 2022
Malware in intentionally-malicious
1 compromised version
- Jun 20, 2022
Malicious code in @w3-commons/js-build-resources (npm)
- Jun 20, 2022
Malicious code in @ibm-pipeline/logging (npm)
- Jun 20, 2022
Malicious code in getting-started-rpi (npm)
- Jun 20, 2022
Malicious code in gcs-malware-scanner (npm)
- Jun 20, 2022
Malware in gcs-malware-scanner
1 compromised version
- Jun 20, 2022
Malware in @ibm-pipeline/logging
1 compromised version
- Jun 20, 2022
Malware in getting-started-rpi
1 compromised version
- Jun 20, 2022
Malware in @w3-commons/js-build-resources
1 compromised version
- Jun 20, 2022
Malicious code in sq-jsith-test-npm-project (npm)
- Jun 20, 2022
Malicious code in discord.js-selfv14 (npm)
- Jun 20, 2022
Malicious code in colors-sync (npm)
- Jun 20, 2022
Malicious code in colors-dev (npm)
- Jun 20, 2022
Malware in discord.js-selfv14
1 compromised version
- Jun 20, 2022
Malware in colors-sync
1 compromised version
- Jun 20, 2022
Malware in sq-jsith-test-npm-project
1 compromised version
- Jun 20, 2022
Malware in colors-dev
1 compromised version
- Jun 20, 2022
Malicious code in slack-notifier-action (npm)
- Jun 20, 2022
Malicious code in seco-leveldown (npm)
- Jun 20, 2022
Malicious code in myhood (npm)
- Jun 20, 2022
Malicious code in @munters/calculations (npm)
- Jun 20, 2022
Malware in slack-notifier-action
1 compromised version
- Jun 20, 2022
Malware in myhood
1 compromised version
- Jun 20, 2022
Malware in @munters/calculations
1 compromised version
- Jun 20, 2022
Malware in seco-leveldown
1 compromised version
- Jun 20, 2022
Malicious code in setup-ruby (npm)
Page 4819 of 4,852