Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
247,767 total in npm · sorted newest first- Jun 20, 2022
Malicious code in shopify-app-node (npm)
- Jun 20, 2022
Malicious code in fitbit-connect-client-api (npm)
- Jun 20, 2022
Malware in fitbit-connect-client-api
1 compromised version
- Jun 20, 2022
Malware in shopify-app-node
1 compromised version
- Jun 20, 2022
Malware in vscode-shadowenv
1 compromised version
- Jun 20, 2022
Malware in shopify-devtool
1 compromised version
- Jun 20, 2022
Malicious code in react-js-buy (npm)
- Jun 20, 2022
Malicious code in planout-editor (npm)
- Jun 20, 2022
Malicious code in linter-rorybot (npm)
- Jun 20, 2022
Malicious code in grabplatform-sample (npm)
- Jun 20, 2022
Malware in react-js-buy
1 compromised version
- Jun 20, 2022
Malware in linter-rorybot
1 compromised version
- Jun 20, 2022
Malware in planout-editor
1 compromised version
- Jun 20, 2022
Malware in grabplatform-sample
1 compromised version
- Jun 20, 2022
Malicious code in site-template (npm)
- Jun 20, 2022
Malicious code in polaris-example-webpack (npm)
- Jun 20, 2022
Malicious code in polaris-example-create-react-app (npm)
- Jun 20, 2022
Malicious code in lyft-oss-website (npm)
- Jun 20, 2022
Malware in polaris-example-webpack
1 compromised version
- Jun 20, 2022
Malware in site-template
1 compromised version
- Jun 20, 2022
Malware in lyft-oss-website
1 compromised version
- Jun 20, 2022
Malware in polaris-example-create-react-app
1 compromised version
- Jun 20, 2022
Malicious code in tengxunnba (npm)
- Jun 20, 2022
Malicious code in reactnativeflipperexample (npm)
- Jun 20, 2022
Malicious code in polaris-example-nextjs (npm)
- Jun 20, 2022
Malicious code in hermes-parser-packages (npm)
- Jun 20, 2022
Malware in hermes-parser-packages
1 compromised version
- Jun 20, 2022
Malware in tengxunnba
1 compromised version
- Jun 20, 2022
Malware in polaris-example-nextjs
1 compromised version
- Jun 20, 2022
Malware in reactnativeflipperexample
1 compromised version
- Jun 20, 2022
Malicious code in vr-webpack (npm)
- Jun 20, 2022
Malicious code in showcar-tracking (npm)
- Jun 20, 2022
Malicious code in hx1-upsrv (npm)
- Jun 20, 2022
Malicious code in hubot-hostinger (npm)
- Jun 20, 2022
Malware in hubot-hostinger
1 compromised version
- Jun 20, 2022
Malware in showcar-tracking
1 compromised version
- Jun 20, 2022
Malware in vr-webpack
1 compromised version
- Jun 20, 2022
Malware in hx1-upsrv
1 compromised version
- Jun 20, 2022
Malicious code in test-h1tu98 (npm)
- Jun 20, 2022
Malicious code in super-streams (npm)
- Jun 20, 2022
Malicious code in public-method-library (npm)
- Jun 20, 2022
Malicious code in lollll (npm)
- Jun 20, 2022
Malware in test-h1tu98
1 compromised version
- Jun 20, 2022
Malware in lollll
1 compromised version
- Jun 20, 2022
Malware in super-streams
1 compromised version
- Jun 20, 2022
Malware in public-method-library
1 compromised version
- Jun 20, 2022
Malicious code in winston-pg-native (npm)
- Jun 20, 2022
Malicious code in testpkgabc (npm)
- Jun 20, 2022
Malicious code in test-hitesh (npm)
- Jun 20, 2022
Malicious code in strapi-provider-upload-aws-s3-auth (npm)
Page 4838 of 4,956