Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,860 total in npm · sorted newest first- Jun 22, 2022
Malicious code in osmosis-frontend (npm)
- Jun 22, 2022
Malicious code in katt-player (npm)
- Jun 22, 2022
Malicious code in jobcoin (npm)
- Jun 22, 2022
Malicious code in front-channel-template (npm)
- Jun 22, 2022
Malicious code in ethmoji-js-demo (npm)
- Jun 22, 2022
Malicious code in dash-generator-test-component-standard (npm)
- Jun 22, 2022
Malicious code in 1uphealth-demo-web-app (npm)
- Jun 22, 2022
Malicious code in consideration-deploy-bot (npm)
- Jun 22, 2022
Malicious code in bakabaka0010 (npm)
- Jun 22, 2022
Malware in front-channel-template
1 compromised version
- Jun 22, 2022
Malware in consideration-deploy-bot
1 compromised version
- Jun 22, 2022
Malware in ethmoji-js-demo
1 compromised version
- Jun 22, 2022
Malware in jobcoin
1 compromised version
- Jun 22, 2022
Malware in bakabaka0010
1 compromised version
- Jun 22, 2022
Malware in osmosis-frontend
1 compromised version
- Jun 22, 2022
Malware in dash-generator-test-component-standard
1 compromised version
- Jun 22, 2022
Malware in smoooth-merchant
1 compromised version
- Jun 22, 2022
Malware in 1uphealth-demo-web-app
1 compromised version
- Jun 22, 2022
Malware in shoppedemo
1 compromised version
- Jun 22, 2022
Malware in katt-player
1 compromised version
- Jun 22, 2022
Malware in wad-workshop-starter
1 compromised version
- Jun 22, 2022
Malware in solid-completions
1 compromised version
- Jun 22, 2022
Malware in omm-frontend
1 compromised version
- Jun 22, 2022
Malicious code in material-ui-plugin-theme-provider-cache (npm)
- Jun 21, 2022
Malicious code in @react-native-tscodegen/tslint-shared (npm)
- Jun 21, 2022
Malware in @react-native-tscodegen/tslint-shared
1 compromised version
- Jun 21, 2022
Malicious code in @atlas-angular/logger (npm)
- Jun 21, 2022
Malware in @atlas-angular/logger
1 compromised version
- Jun 21, 2022
Malicious code in mephisto-worker-experience (npm)
- Jun 21, 2022
Malware in mephisto-worker-experience
1 compromised version
- Jun 21, 2022
Malicious code in vngage-scheduler (npm)
- Jun 21, 2022
Malware in vngage-scheduler
1 compromised version
- Jun 21, 2022
Malicious code in cvent-web-components (npm)
- Jun 21, 2022
Malware in cvent-web-components
1 compromised version
- Jun 21, 2022
Malicious code in omm-frontend (npm)
- Jun 20, 2022
Malicious code in @sfcc-core/core (npm)
- Jun 20, 2022
Malicious code in @robinhoodcoop/contracts (npm)
- Jun 20, 2022
Malicious code in globo-ab-client (npm)
- Jun 20, 2022
Malware in @robinhoodcoop/contracts
1 compromised version
- Jun 20, 2022
Malware in globo-ab-client
1 compromised version
- Jun 20, 2022
Malware in @sfcc-core/core
1 compromised version
- Jun 20, 2022
Malicious code in taxjar-blog (npm)
- Jun 20, 2022
Malicious code in stitch-fix-women (npm)
- Jun 20, 2022
Malicious code in muzli-extension (npm)
- Jun 20, 2022
Malicious code in kiku-web (npm)
- Jun 20, 2022
Malicious code in default-static-site (npm)
- Jun 20, 2022
Malware in default-static-site
1 compromised version
- Jun 20, 2022
Malware in stitch-fix-women
1 compromised version
- Jun 20, 2022
Malware in taxjar-blog
1 compromised version
- Jun 20, 2022
Malware in kiku-web
1 compromised version
Page 4874 of 5,078