Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,878 total in npm · sorted newest first- Jul 8, 2022
Malware in @puresec/addressparser-malicious
1 compromised version
- Jul 8, 2022
Malicious code in compromised-npm-package (npm)
- Jul 8, 2022
Malware in compromised-npm-package
1 compromised version
- Jul 8, 2022
Malicious code in @tickertape/protos-pbjs (npm)
- Jul 8, 2022
Malware in @tickertape/protos-pbjs
1 compromised version
- Jul 8, 2022
Malicious code in chart.js-legacy (npm)
- Jul 8, 2022
Malware in chart.js-legacy
1 compromised version
- Jul 8, 2022
Malicious code in axiom-base (npm)
- Jul 8, 2022
Malware in axiom-base
1 compromised version
- Jul 8, 2022
Malicious code in npm_jithin_package (npm)
- Jul 8, 2022
Malicious code in arc-canonical (npm)
- Jul 8, 2022
Malware in arc-canonical
1 compromised version
- Jul 8, 2022
Malware in npm_jithin_package
1 compromised version
- Jul 8, 2022
Malicious code in nexus-snyk-security-plugin (npm)
- Jul 8, 2022
Malware in nexus-snyk-security-plugin
1 compromised version
- Jul 8, 2022
Malicious code in install-matlab (npm)
- Jul 8, 2022
Malware in install-matlab
1 compromised version
- Jul 8, 2022
Malicious code in pratikyadavh1 (npm)
- Jul 8, 2022
Malware in pratikyadavh1
1 compromised version
- Jul 8, 2022
Malicious code in tmeme (npm)
- Jul 8, 2022
Malicious code in tjhnl (npm)
- Jul 8, 2022
Malware in tmeme
1 compromised version
- Jul 8, 2022
Malware in tjhnl
1 compromised version
- Jul 8, 2022
Malicious code in wallet-recovery-wizard (npm)
- Jul 8, 2022
Malicious code in ben1 (npm)
- Jul 8, 2022
Malware in ben1
1 compromised version
- Jul 8, 2022
Malware in wallet-recovery-wizard
1 compromised version
- Jul 8, 2022
Malicious code in test-aaa-yyyy-zzz (npm)
- Jul 8, 2022
Malicious code in specproject-template (npm)
- Jul 8, 2022
Malware in specproject-template
1 compromised version
- Jul 8, 2022
Malware in test-aaa-yyyy-zzz
1 compromised version
- Jul 8, 2022
Malicious code in pegleg_heart (npm)
- Jul 8, 2022
Malware in pegleg_heart
1 compromised version
- Jul 8, 2022
Malicious code in internallib_v847 (npm)
- Jul 8, 2022
Malicious code in @inaciot/internallib_v243 (npm)
- Jul 8, 2022
Malware in internallib_v847
1 compromised version
- Jul 8, 2022
Malware in @inaciot/internallib_v243
1 compromised version
- Jul 8, 2022
Malicious code in skyscanner.github.io (npm)
- Jul 8, 2022
Malware in skyscanner.github.io
1 compromised version
- Jul 8, 2022
Malicious code in teamcity-cloud-agent-updater (npm)
- Jul 8, 2022
Malicious code in sketch-pexels (npm)
- Jul 8, 2022
Malicious code in legendggwp (npm)
- Jul 8, 2022
Malware in legendggwp
1 compromised version
- Jul 8, 2022
Malware in sketch-pexels
1 compromised version
- Jul 8, 2022
Malware in teamcity-cloud-agent-updater
1 compromised version
- Jul 8, 2022
Malicious code in sync-process (npm)
- Jul 8, 2022
Malicious code in small-ms (npm)
- Jul 8, 2022
Malicious code in node-child (npm)
- Jul 8, 2022
Malicious code in emojis-discord (npm)
- Jul 8, 2022
Malware in small-ms
1 compromised version
Page 4870 of 5,078