Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
241,528 total in npm · sorted newest first- Jun 1, 2022
Malicious code in @image-process-library/blob-to-base64 (npm)
- Jun 1, 2022
Malware in @image-process-library/blob-to-base64
1 compromised version
- Jun 1, 2022
Malicious code in @tilliwilli/npm-lifecycles (npm)
- Jun 1, 2022
Malware in @tilliwilli/npm-lifecycles
1 compromised version
- Jun 1, 2022
Malicious code in @visiology-public-utilities/language-utils (npm)
- Jun 1, 2022
Malware in @visiology-public-utilities/language-utils
1 compromised version
- Jun 1, 2022
Malicious code in react-transition-group-community-version (npm)
- Jun 1, 2022
Malware in react-transition-group-community-version
1 compromised version
- Jun 1, 2022
Malicious code in @s3p-js-deep-purple/utils (npm)
- Jun 1, 2022
Malware in @s3p-js-deep-purple/utils
1 compromised version
- Jun 1, 2022
Malicious code in @amcdc/backend-api-swagger (npm)
- Jun 1, 2022
Malware in @amcdc/backend-api-swagger
1 compromised version
- Jun 1, 2022
Malicious code in kntl-digital3 (npm)
- Jun 1, 2022
Malware in kntl-digital3
1 compromised version
- Jun 1, 2022
Malicious code in depedence-confusion (npm)
- Jun 1, 2022
Malware in depedence-confusion
1 compromised version
- Jun 1, 2022
Malicious code in @azure-test2/test2 (npm)
- Jun 1, 2022
Malware in @azure-test2/test2
1 compromised version
- Jun 1, 2022
Malicious code in pocjenkircetest (npm)
- Jun 1, 2022
Malware in pocjenkircetest
1 compromised version
- Jun 1, 2022
Malicious code in hach-package-manager-bounty-hunter (npm)
- Jun 1, 2022
Malware in hach-package-manager-bounty-hunter
1 compromised version
- Jun 1, 2022
Malicious code in colors-support (npm)
- Jun 1, 2022
Malware in colors-support
1 compromised version
- Jun 1, 2022
Malicious code in titles (npm)
- Jun 1, 2022
Malicious code in sync-colors (npm)
- Jun 1, 2022
Malicious code in support-colors (npm)
- Jun 1, 2022
Malware in support-colors
1 compromised version
- Jun 1, 2022
Malware in sync-colors
1 compromised version
- Jun 1, 2022
Malware in titles
1 compromised version
- May 31, 2022
Malicious code in gatsby-plugin-conecad (npm)
- May 31, 2022
Malware in gatsby-plugin-conecad
1 compromised version
- May 31, 2022
Malicious code in @iwcp/nebula-ui (npm)
- May 31, 2022
Malware in @iwcp/nebula-ui
1 compromised version
- May 31, 2022
Malicious code in react-dom-router-compatibility (npm)
- May 31, 2022
Malware in react-dom-router-compatibility
1 compromised version
- May 31, 2022
Malicious code in react-dom-router-old (npm)
- May 31, 2022
Malware in react-dom-router-old
1 compromised version
- May 31, 2022
Malicious code in rkpacktest (npm)
- May 31, 2022
Malicious code in rkdvil (npm)
- May 31, 2022
Malware in rkpacktest
1 compromised version
- May 31, 2022
Malware in rkdvil
1 compromised version
- May 31, 2022
Malicious code in npm_ransomware (npm)
- May 31, 2022
Malware in npm_ransomware
1 compromised version
- May 31, 2022
Malicious code in stripe-connect-rocketrides (npm)
- May 31, 2022
Malicious code in sixt (npm)
- May 31, 2022
Malicious code in orangeonion.buildtools (npm)
- May 31, 2022
Malicious code in mb-blog (npm)
- May 31, 2022
Malicious code in lyft-avidl (npm)
- May 31, 2022
Malicious code in holvipartners (npm)
Page 4823 of 4,831