Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,861 total in npm · sorted newest first- Jul 5, 2022
Malicious code in @trp-gims-usi-cip/web-portal-lib (npm)
- Jul 5, 2022
Malware in @trp-gims-usi-cip/web-portal-lib
1 compromised version
- Jul 5, 2022
Malicious code in green-color (npm)
- Jul 5, 2022
Malware in green-color
1 compromised version
- Jul 5, 2022
Malicious code in zen-website (npm)
- Jul 5, 2022
Malicious code in react-bank-api (npm)
- Jul 5, 2022
Malicious code in pipeline-npm-artifactory (npm)
- Jul 5, 2022
Malicious code in frogsui (npm)
- Jul 5, 2022
Malicious code in fecustomui (npm)
- Jul 5, 2022
Malware in pipeline-npm-artifactory
1 compromised version
- Jul 5, 2022
Malware in frogsui
1 compromised version
- Jul 5, 2022
Malware in fecustomui
1 compromised version
- Jul 5, 2022
Malware in react-bank-api
1 compromised version
- Jul 5, 2022
Malware in zen-website
1 compromised version
- Jul 5, 2022
Malicious code in usersnap-frontend (npm)
- Jul 5, 2022
Malicious code in hhsoig-design-system-core (npm)
- Jul 5, 2022
Malware in hhsoig-design-system-core
1 compromised version
- Jul 5, 2022
Malware in usersnap-frontend
1 compromised version
- Jul 5, 2022
Malicious code in indrasecuritylib (npm)
- Jul 5, 2022
Malware in indrasecuritylib
1 compromised version
- Jul 5, 2022
Malicious code in v12-discord.js (npm)
- Jul 5, 2022
Malicious code in node-title (npm)
- Jul 5, 2022
Malicious code in node-colors-gen (npm)
- Jul 5, 2022
Malware in node-title
1 compromised version
- Jul 5, 2022
Malware in node-colors-gen
1 compromised version
- Jul 5, 2022
Malware in v12-discord.js
1 compromised version
- Jun 30, 2022
Malicious code in thisisourgoal1 (npm)
- Jun 30, 2022
Malicious code in thisisourgoal (npm)
- Jun 30, 2022
Malware in thisisourgoal
1 compromised version
- Jun 30, 2022
Malware in thisisourgoal1
1 compromised version
- Jun 30, 2022
Malicious code in material-ui-plugin-styles-provider-cache (npm)
- Jun 30, 2022
Malware in material-ui-plugin-styles-provider-cache
1 compromised version
- Jun 30, 2022
Malware in material-ui-plugin-theme-provider-cache
1 compromised version
- Jun 30, 2022
Malicious code in @pagetour/sdk (npm)
- Jun 30, 2022
Malware in @pagetour/sdk
1 compromised version
- Jun 30, 2022
Malicious code in @3p-future-solutions/ember-cui (npm)
- Jun 30, 2022
Malware in @3p-future-solutions/ember-cui
1 compromised version
- Jun 30, 2022
Malicious code in slack-trustpilot (npm)
- Jun 30, 2022
Malicious code in sichain-api (npm)
- Jun 30, 2022
Malicious code in separatecalculatingbinary (npm)
- Jun 30, 2022
Malicious code in cleansheet (npm)
- Jun 30, 2022
Malware in sichain-api
1 compromised version
- Jun 30, 2022
Malware in separatecalculatingbinary
1 compromised version
- Jun 30, 2022
Malware in cleansheet
1 compromised version
- Jun 30, 2022
Malware in slack-trustpilot
1 compromised version
- Jun 30, 2022
Malicious code in purple_team_midway_teste_cenario_2 (npm)
- Jun 30, 2022
Malicious code in purple_team_midway_teste_cenario_1 (npm)
- Jun 30, 2022
Malicious code in purple_team_midway_cenario_2 (npm)
- Jun 30, 2022
Malicious code in purple_team_midway_cenario_1 (npm)
- Jun 30, 2022
Malware in purple_team_midway_cenario_2
1 compromised version
Page 4872 of 5,078