Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
247,773 total in npm · sorted newest first- Jun 20, 2022
Malware in tesla-pre-delivery-onboarding
1 compromised version
- Jun 20, 2022
Malware in ucs-timepicker
1 compromised version
- Jun 20, 2022
Malware in ucs-map
1 compromised version
- Jun 20, 2022
Malware in ucs-list
1 compromised version
- Jun 20, 2022
Malicious code in vc-web (npm)
- Jun 20, 2022
Malicious code in usaa-analytics (npm)
- Jun 20, 2022
Malicious code in ui-dependency-confusion (npm)
- Jun 20, 2022
Malicious code in ucs-data-table (npm)
- Jun 20, 2022
Malicious code in ucs-availability-status-chart (npm)
- Jun 20, 2022
Malware in usaa-analytics
1 compromised version
- Jun 20, 2022
Malware in ucs-data-table
1 compromised version
- Jun 20, 2022
Malware in vc-web
1 compromised version
- Jun 20, 2022
Malware in ui-dependency-confusion
1 compromised version
- Jun 20, 2022
Malware in ucs-availability-status-chart
1 compromised version
- Jun 20, 2022
Malicious code in xo-webpack-config (npm)
- Jun 20, 2022
Malicious code in wjaxx-test (npm)
- Jun 20, 2022
Malicious code in web-commons (npm)
- Jun 20, 2022
Malware in wjaxx-test
1 compromised version
- Jun 20, 2022
Malware in web-commons
1 compromised version
- Jun 20, 2022
Malware in xo-webpack-config
1 compromised version
- Jun 20, 2022
Malicious code in yahoo-react-checkbox-group (npm)
- Jun 20, 2022
Malicious code in hs-promise-utils (npm)
- Jun 20, 2022
Malicious code in bender-lyaml-loader (npm)
- Jun 20, 2022
Malicious code in bananabr-dep-confusion (npm)
- Jun 20, 2022
Malicious code in azure-graphrbac (npm)
- Jun 20, 2022
Malware in bender-lyaml-loader
1 compromised version
- Jun 20, 2022
Malware in hs-promise-utils
1 compromised version
- Jun 20, 2022
Malware in azure-graphrbac
1 compromised version
- Jun 20, 2022
Malware in bananabr-dep-confusion
1 compromised version
- Jun 20, 2022
Malware in yahoo-react-checkbox-group
1 compromised version
- Jun 20, 2022
Malicious code in dcrtimegui (npm)
- Jun 20, 2022
Malicious code in curri-slack (npm)
- Jun 20, 2022
Malicious code in biz-vue-communications (npm)
- Jun 20, 2022
Malware in curri-slack
1 compromised version
- Jun 20, 2022
Malware in dcrtimegui
1 compromised version
- Jun 20, 2022
Malware in biz-vue-communications
1 compromised version
- Jun 20, 2022
Malicious code in tidal-contracts (npm)
- Jun 20, 2022
Malicious code in functionteszt (npm)
- Jun 20, 2022
Malicious code in dnsteszt (npm)
- Jun 20, 2022
Malicious code in barnbridge-frontend (npm)
- Jun 20, 2022
Malware in functionteszt
1 compromised version
- Jun 20, 2022
Malware in tidal-contracts
1 compromised version
- Jun 20, 2022
Malware in dnsteszt
1 compromised version
- Jun 20, 2022
Malware in barnbridge-frontend
1 compromised version
- Jun 20, 2022
Malicious code in teller-protocol (npm)
- Jun 20, 2022
Malicious code in tellar-protocol (npm)
- Jun 20, 2022
Malicious code in fe-avaya-chat-client (npm)
- Jun 20, 2022
Malicious code in dforce-protocol (npm)
- Jun 20, 2022
Malicious code in barnbridge-dao (npm)
- Jun 20, 2022
Malware in tellar-protocol
1 compromised version
Page 4837 of 4,956