Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
247,637 total in npm · sorted newest first- Jun 20, 2022
Malware in youtrack-reports-widgets
1 compromised version
- Jun 20, 2022
Malware in flat-surface-shader
1 compromised version
- Jun 20, 2022
Malicious code in youtrack-issues-list-widget (npm)
- Jun 20, 2022
Malicious code in youtrack-activities-widget (npm)
- Jun 20, 2022
Malicious code in kotlinlang.org (npm)
- Jun 20, 2022
Malicious code in gatsby-site (npm)
- Jun 20, 2022
Malware in gatsby-site
1 compromised version
- Jun 20, 2022
Malware in kotlinlang.org
1 compromised version
- Jun 20, 2022
Malware in youtrack-issues-list-widget
1 compromised version
- Jun 20, 2022
Malware in youtrack-activities-widget
1 compromised version
- Jun 20, 2022
Malicious code in youtrack-board-status-widget (npm)
- Jun 20, 2022
Malicious code in whatsnewingoland (npm)
- Jun 20, 2022
Malicious code in revoke-user-access (npm)
- Jun 20, 2022
Malicious code in hub-project-team-widget (npm)
- Jun 20, 2022
Malicious code in duty-manager (npm)
- Jun 20, 2022
Malware in whatsnewingoland
1 compromised version
- Jun 20, 2022
Malware in duty-manager
1 compromised version
- Jun 20, 2022
Malware in youtrack-board-status-widget
1 compromised version
- Jun 20, 2022
Malware in revoke-user-access
1 compromised version
- Jun 20, 2022
Malware in hub-project-team-widget
1 compromised version
- Jun 20, 2022
Malicious code in youtrack-exportable-work-items-widget (npm)
- Jun 20, 2022
Malicious code in teamcity-vscode-extension (npm)
- Jun 20, 2022
Malicious code in rider-debug-visualizer (npm)
- Jun 20, 2022
Malicious code in oss-site-jekyll-theme (npm)
- Jun 20, 2022
Malware in teamcity-vscode-extension
1 compromised version
- Jun 20, 2022
Malware in youtrack-exportable-work-items-widget
1 compromised version
- Jun 20, 2022
Malware in rider-debug-visualizer
1 compromised version
- Jun 20, 2022
Malware in oss-site-jekyll-theme
1 compromised version
- Jun 20, 2022
Malicious code in teamcity-react-demo (npm)
- Jun 20, 2022
Malicious code in teamcity-react (npm)
- Jun 20, 2022
Malicious code in teamcity-build-artifacts-widget (npm)
- Jun 20, 2022
Malicious code in hub-rss-widget (npm)
- Jun 20, 2022
Malware in teamcity-react
1 compromised version
- Jun 20, 2022
Malware in teamcity-build-artifacts-widget
1 compromised version
- Jun 20, 2022
Malware in hub-rss-widget
1 compromised version
- Jun 20, 2022
Malware in teamcity-react-demo
1 compromised version
- Jun 20, 2022
Malicious code in youtrack-personal-timetracking-widget (npm)
- Jun 20, 2022
Malicious code in teamcity-build-artifacts (npm)
- Jun 20, 2022
Malicious code in jb-rpd-splash (npm)
- Jun 20, 2022
Malicious code in hub-rss (npm)
- Jun 20, 2022
Malware in jb-rpd-splash
1 compromised version
- Jun 20, 2022
Malware in teamcity-build-artifacts
1 compromised version
- Jun 20, 2022
Malware in hub-rss
1 compromised version
- Jun 20, 2022
Malware in youtrack-personal-timetracking-widget
1 compromised version
- Jun 20, 2022
Malicious code in youtrack-personal-timetracking (npm)
- Jun 20, 2022
Malicious code in teamcity-investigations (npm)
- Jun 20, 2022
Malicious code in mocha-intellij (npm)
- Jun 20, 2022
Malicious code in colorschemetool (npm)
- Jun 20, 2022
Malware in mocha-intellij
1 compromised version
- Jun 20, 2022
Malware in colorschemetool
1 compromised version
Page 4847 of 4,953