Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,861 total in npm · sorted newest first- Jun 30, 2022
Malware in purple_team_midway_cenario_1
1 compromised version
- Jun 30, 2022
Malware in purple_team_midway_teste_cenario_2
1 compromised version
- Jun 30, 2022
Malware in purple_team_midway_teste_cenario_1
1 compromised version
- Jun 30, 2022
Malicious code in syndis-test (npm)
- Jun 30, 2022
Malware in syndis-test
1 compromised version
- Jun 30, 2022
Malicious code in web3-integration (npm)
- Jun 30, 2022
Malware in web3-integration
1 compromised version
- Jun 30, 2022
Malicious code in @it-eng/is-dinosaur (npm)
- Jun 30, 2022
Malware in @it-eng/is-dinosaur
1 compromised version
- Jun 30, 2022
Malicious code in swaty-color (npm)
- Jun 30, 2022
Malware in swaty-color
1 compromised version
- Jun 30, 2022
Malicious code in npmbb-deneuve81 (npm)
- Jun 30, 2022
Malware in npmbb-deneuve81
1 compromised version
- Jun 30, 2022
Malicious code in shda (npm)
- Jun 30, 2022
Malware in shda
1 compromised version
- Jun 30, 2022
Malicious code in personal-colors-kash (npm)
- Jun 30, 2022
Malware in personal-colors-kash
1 compromised version
- Jun 30, 2022
Malicious code in vazgarules (npm)
- Jun 30, 2022
Malware in vazgarules
1 compromised version
- Jun 30, 2022
Malicious code in @radancy/dropr-client (npm)
- Jun 30, 2022
Malware in @radancy/dropr-client
1 compromised version
- Jun 30, 2022
Malicious code in vipps-stitches (npm)
- Jun 30, 2022
Malware in vipps-stitches
1 compromised version
- Jun 30, 2022
Malicious code in rhynocallbackpackage (npm)
- Jun 30, 2022
Malware in rhynocallbackpackage
1 compromised version
- Jun 29, 2022
Malicious code in horizon_dev (npm)
- Jun 29, 2022
Malware in horizon_dev
1 compromised version
- Jun 27, 2022
Malicious code in discordselfbotv16 (npm)
- Jun 27, 2022
Malicious code in discordselfbotv15 (npm)
- Jun 27, 2022
Malicious code in discordjs-selfbot-v17 (npm)
- Jun 27, 2022
Malicious code in discorddependency (npm)
- Jun 27, 2022
Malware in discordjs-selfbot-v17
1 compromised version
- Jun 27, 2022
Malware in discordselfbotv15
1 compromised version
- Jun 27, 2022
Malware in discordselfbotv16
1 compromised version
- Jun 27, 2022
Malware in discorddependency
1 compromised version
- Jun 22, 2022
Malicious code in bumblogger (npm)
- Jun 22, 2022
Malware in bumblogger
1 compromised version
- Jun 22, 2022
Malicious code in @amplify-components/amplify-table (npm)
- Jun 22, 2022
Malware in @amplify-components/amplify-table
1 compromised version
- Jun 22, 2022
Malicious code in euscp (npm)
- Jun 22, 2022
Malware in euscp
1 compromised version
- Jun 22, 2022
Malicious code in elementor.developers (npm)
- Jun 22, 2022
Malware in elementor.developers
1 compromised version
- Jun 22, 2022
Malicious code in slg-vue-components (npm)
- Jun 22, 2022
Malicious code in slg-shared-utils (npm)
- Jun 22, 2022
Malware in slg-vue-components
1 compromised version
- Jun 22, 2022
Malware in slg-shared-utils
1 compromised version
- Jun 22, 2022
Malicious code in wad-workshop-starter (npm)
- Jun 22, 2022
Malicious code in solid-completions (npm)
- Jun 22, 2022
Malicious code in smoooth-merchant (npm)
Page 4873 of 5,078