Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,861 total in npm · sorted newest first- Jul 6, 2022
Malicious code in icons-packages (npm)
1 compromised version
- Jul 6, 2022
Malicious code in icons-pack (npm)
1 compromised version
- Jul 6, 2022
Malware in ionicon-package
1 compromised version
- Jul 6, 2022
Malware in script-package
1 compromised version
- Jul 6, 2022
Malware in icons-packages
1 compromised version
- Jul 6, 2022
Malware in ionicons-pack
1 compromised version
- Jul 6, 2022
Malware in pack-icons
1 compromised version
- Jul 6, 2022
Malware in icons-pack
1 compromised version
- Jul 6, 2022
Malicious code in ajax-libz (npm)
1 compromised version
- Jul 6, 2022
Malicious code in ajax-googleapis (npm)
1 compromised version
- Jul 6, 2022
Malicious code in wkwk100 (npm)
1 compromised version
- Jul 6, 2022
Malicious code in tezdoank (npm)
2 compromised versions
- Jul 6, 2022
Malicious code in swiper-bundle (npm)
5 compromised versions
- Jul 6, 2022
Malicious code in swiper-bundie (npm)
1 compromised version
- Jul 6, 2022
Malicious code in roar-02 (npm)
1 compromised version
- Jul 6, 2022
Malicious code in roar-01 (npm)
1 compromised version
- Jul 6, 2022
Malicious code in atez (npm)
1 compromised version
- Jul 6, 2022
Malware in ajax-libz
1 compromised version
- Jul 6, 2022
Malware in wkwk100
1 compromised version
- Jul 6, 2022
Malware in swiper-bundle
1 compromised version
- Jul 6, 2022
Malware in tezdoank
1 compromised version
- Jul 6, 2022
Malware in atez
1 compromised version
- Jul 6, 2022
Malware in roar-02
1 compromised version
- Jul 6, 2022
Malware in swiper-bundie
1 compromised version
- Jul 6, 2022
Malware in ajax-googleapis
1 compromised version
- Jul 6, 2022
Malware in roar-01
1 compromised version
- Jul 6, 2022
Malicious code in footericon (npm)
5 compromised versions
- Jul 6, 2022
Malware in footericon
1 compromised version
- Jul 6, 2022
Malicious code in ionicio (npm)
1 compromised version
- Jul 6, 2022
Malicious code in ionic-icon (npm)
1 compromised version
- Jul 6, 2022
Malware in ionic-icon
1 compromised version
- Jul 6, 2022
Malware in ionicio
1 compromised version
- Jul 6, 2022
Malicious code in ajax-libs (npm)
3 compromised versions
- Jul 6, 2022
Malicious code in ajax-library (npm)
2 compromised versions
- Jul 6, 2022
Malicious code in umbrellaks (npm)
1 compromised version
- Jul 6, 2022
Malicious code in icon-package (npm)
18 compromised versions
- Jul 6, 2022
Malware in icon-package
1 compromised version
- Jul 6, 2022
Malware in ajax-library
1 compromised version
- Jul 6, 2022
Malware in umbrellaks
1 compromised version
- Jul 6, 2022
Malware in ajax-libs
1 compromised version
- Jul 5, 2022
Malicious code in @cuda-networks/bds-core (npm)
- Jul 5, 2022
Malware in @cuda-networks/bds-core
1 compromised version
- Jul 5, 2022
Malicious code in eslint-plugin-translation-vars (npm)
- Jul 5, 2022
Malware in eslint-plugin-translation-vars
1 compromised version
- Jul 5, 2022
Malicious code in @ovh-ui/oui-checkbox (npm)
- Jul 5, 2022
Malware in @ovh-ui/oui-checkbox
1 compromised version
- Jul 5, 2022
Malicious code in io-components (npm)
- Jul 5, 2022
Malicious code in cd-system (npm)
- Jul 5, 2022
Malware in cd-system
1 compromised version
- Jul 5, 2022
Malware in io-components
1 compromised version
Page 4871 of 5,078