Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
247,787 total in npm · sorted newest first- Jun 20, 2022
Malware in karma-puppeteer-client
1 compromised version
- Jun 20, 2022
Malware in openstack-api-client
1 compromised version
- Jun 20, 2022
Malicious code in test-peleg (npm)
- Jun 20, 2022
Malicious code in @shizzy/suckaaa (npm)
- Jun 20, 2022
Malicious code in @shizzy/jk (npm)
- Jun 20, 2022
Malicious code in polarloft-discord (npm)
- Jun 20, 2022
Malicious code in n3mo-calc69 (npm)
- Jun 20, 2022
Malware in polarloft-discord
1 compromised version
- Jun 20, 2022
Malware in @shizzy/suckaaa
1 compromised version
- Jun 20, 2022
Malware in n3mo-calc69
1 compromised version
- Jun 20, 2022
Malware in test-peleg
1 compromised version
- Jun 20, 2022
Malware in @shizzy/jk
1 compromised version
- Jun 20, 2022
Malicious code in @shizzy/bronky (npm)
- Jun 20, 2022
Malicious code in discordselfbots (npm)
- Jun 20, 2022
Malicious code in discordjs-lofy (npm)
- Jun 20, 2022
Malware in @shizzy/bronky
1 compromised version
- Jun 20, 2022
Malware in discordjs-lofy
1 compromised version
- Jun 20, 2022
Malware in discordselfbots
1 compromised version
- Jun 20, 2022
Malicious code in ac-event-emitter (npm)
- Jun 20, 2022
Malicious code in ac-base (npm)
- Jun 20, 2022
Malicious code in fuckfuckapk (npm)
- Jun 20, 2022
Malicious code in ccxp (npm)
- Jun 20, 2022
Malware in ac-base
1 compromised version
- Jun 20, 2022
Malware in fuckfuckapk
1 compromised version
- Jun 20, 2022
Malware in ccxp
1 compromised version
- Jun 20, 2022
Malware in ac-event-emitter
1 compromised version
- Jun 20, 2022
Malicious code in ac-deferred (npm)
- Jun 20, 2022
Malicious code in ac-animation-sequencer (npm)
- Jun 20, 2022
Malicious code in uxpin-merge-ms-fabric (npm)
- Jun 20, 2022
Malicious code in rror.stack (npm)
- Jun 20, 2022
Malicious code in cloudshell-session (npm)
- Jun 20, 2022
Malware in uxpin-merge-ms-fabric
1 compromised version
- Jun 20, 2022
Malware in cloudshell-session
1 compromised version
- Jun 20, 2022
Malware in rror.stack
1 compromised version
- Jun 20, 2022
Malware in ac-animation-sequencer
1 compromised version
- Jun 20, 2022
Malware in ac-deferred
1 compromised version
- Jun 20, 2022
Malicious code in usaa-oauth (npm)
- Jun 20, 2022
Malicious code in snackbars (npm)
- Jun 20, 2022
Malicious code in load-image-exif (npm)
- Jun 20, 2022
Malicious code in idcs-page-header (npm)
- Jun 20, 2022
Malware in idcs-page-header
1 compromised version
- Jun 20, 2022
Malware in load-image-exif
1 compromised version
- Jun 20, 2022
Malware in usaa-oauth
1 compromised version
- Jun 20, 2022
Malware in snackbars
1 compromised version
- Jun 20, 2022
Malicious code in @audi-cct/teaser-feature-app (npm)
- Jun 20, 2022
Malicious code in zmarta-analytics (npm)
- Jun 20, 2022
Malicious code in toosting (npm)
- Jun 20, 2022
Malicious code in prettier-linter-helper (npm)
- Jun 20, 2022
Malware in prettier-linter-helper
1 compromised version
- Jun 20, 2022
Malware in toosting
1 compromised version
Page 4833 of 4,956