Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
247,637 total in npm · sorted newest first- Jun 20, 2022
Malicious code in spreaker-sdk-js (npm)
- Jun 20, 2022
Malicious code in js-lib-terminal-integration-example (npm)
- Jun 20, 2022
Malicious code in js-lib-terminal-integration (npm)
- Jun 20, 2022
Malicious code in eclipse-typescript (npm)
- Jun 20, 2022
Malware in eclipse-typescript
1 compromised version
- Jun 20, 2022
Malware in js-lib-terminal-integration
1 compromised version
- Jun 20, 2022
Malware in spreaker-sdk-js
1 compromised version
- Jun 20, 2022
Malware in js-lib-terminal-integration-example
1 compromised version
- Jun 20, 2022
Malicious code in util-raml-code-generator (npm)
- Jun 20, 2022
Malicious code in skeleton-js-task (npm)
- Jun 20, 2022
Malicious code in js-lib-skeleton (npm)
- Jun 20, 2022
Malicious code in expect-rn (npm)
- Jun 20, 2022
Malware in js-lib-skeleton
1 compromised version
- Jun 20, 2022
Malware in util-raml-code-generator
1 compromised version
- Jun 20, 2022
Malware in expect-rn
1 compromised version
- Jun 20, 2022
Malware in skeleton-js-task
1 compromised version
- Jun 20, 2022
Malicious code in wallet-cli-tools (npm)
- Jun 20, 2022
Malicious code in leaflet-opencage-search (npm)
- Jun 20, 2022
Malicious code in deskera-cli (npm)
- Jun 20, 2022
Malicious code in bcoin-mongo-api (npm)
- Jun 20, 2022
Malware in deskera-cli
1 compromised version
- Jun 20, 2022
Malware in leaflet-opencage-search
1 compromised version
- Jun 20, 2022
Malware in bcoin-mongo-api
1 compromised version
- Jun 20, 2022
Malware in wallet-cli-tools
1 compromised version
- Jun 20, 2022
Malicious code in pay-with-bitpay (npm)
- Jun 20, 2022
Malicious code in icv2-plugin-client (npm)
- Jun 20, 2022
Malicious code in copay-sign (npm)
- Jun 20, 2022
Malicious code in bitcore-payment-codes (npm)
- Jun 20, 2022
Malicious code in bcoin-mongo-models (npm)
- Jun 20, 2022
Malware in icv2-plugin-client
1 compromised version
- Jun 20, 2022
Malware in pay-with-bitpay
1 compromised version
- Jun 20, 2022
Malware in bcoin-mongo-models
1 compromised version
- Jun 20, 2022
Malware in bitcore-payment-codes
1 compromised version
- Jun 20, 2022
Malware in copay-sign
1 compromised version
- Jun 20, 2022
Malicious code in topup (npm)
- Jun 20, 2022
Malicious code in icv2-plugin (npm)
- Jun 20, 2022
Malicious code in icv2 (npm)
- Jun 20, 2022
Malicious code in cash-translator (npm)
- Jun 20, 2022
Malware in icv2-plugin
1 compromised version
- Jun 20, 2022
Malware in cash-translator
1 compromised version
- Jun 20, 2022
Malware in topup
1 compromised version
- Jun 20, 2022
Malware in icv2
1 compromised version
- Jun 20, 2022
Malicious code in modlink (npm)
- Jun 20, 2022
Malicious code in insight-website (npm)
- Jun 20, 2022
Malicious code in i-made-this (npm)
- Jun 20, 2022
Malware in insight-website
1 compromised version
- Jun 20, 2022
Malware in modlink
1 compromised version
- Jun 20, 2022
Malware in i-made-this
1 compromised version
- Jun 20, 2022
Malicious code in satoshi-fire-alarm (npm)
- Jun 20, 2022
Malicious code in lemonade-stand (npm)
Page 4850 of 4,953