Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,860 total in npm · sorted newest first- Jun 20, 2022
Malware in turing-ui
1 compromised version
- Jun 20, 2022
Malicious code in nf-data-explorer-2 (npm)
- Jun 20, 2022
Malicious code in nextjs-accelerator (npm)
- Jun 20, 2022
Malicious code in auth0-react-03-calling-an-api (npm)
- Jun 20, 2022
Malware in nf-data-explorer-2
1 compromised version
- Jun 20, 2022
Malware in nextjs-accelerator
1 compromised version
- Jun 20, 2022
Malware in auth0-react-03-calling-an-api
1 compromised version
- Jun 20, 2022
Malicious code in nodejs-docs-samples-iot-mqtt-example (npm)
- Jun 20, 2022
Malicious code in nestjs-proxy (npm)
- Jun 20, 2022
Malicious code in loblaws-product-listing (npm)
- Jun 20, 2022
Malicious code in ffdc-corporate-banking-sample (npm)
- Jun 20, 2022
Malicious code in ffdc-api-security (npm)
- Jun 20, 2022
Malicious code in donate-backend (npm)
- Jun 20, 2022
Malware in ffdc-api-security
1 compromised version
- Jun 20, 2022
Malware in nestjs-proxy
1 compromised version
- Jun 20, 2022
Malware in ffdc-corporate-banking-sample
1 compromised version
- Jun 20, 2022
Malware in nodejs-docs-samples-iot-mqtt-example
1 compromised version
- Jun 20, 2022
Malware in donate-backend
1 compromised version
- Jun 20, 2022
Malware in loblaws-product-listing
1 compromised version
- Jun 20, 2022
Malicious code in finastra.design (npm)
- Jun 20, 2022
Malicious code in finastra (npm)
- Jun 20, 2022
Malicious code in fds-test (npm)
- Jun 20, 2022
Malware in finastra
1 compromised version
- Jun 20, 2022
Malware in fds-test
1 compromised version
- Jun 20, 2022
Malware in finastra.design
1 compromised version
- Jun 20, 2022
Malicious code in gulp-csslint-lesss-reporter (npm)
- Jun 20, 2022
Malicious code in finastra-nodejs-libs (npm)
- Jun 20, 2022
Malicious code in finastra-design-system (npm)
- Jun 20, 2022
Malicious code in backbone-typescripts-accessor-generator (npm)
- Jun 20, 2022
Malware in gulp-csslint-lesss-reporter
1 compromised version
- Jun 20, 2022
Malware in finastra-design-system
1 compromised version
- Jun 20, 2022
Malware in backbone-typescripts-accessor-generator
1 compromised version
- Jun 20, 2022
Malware in finastra-nodejs-libs
1 compromised version
- Jun 20, 2022
Malicious code in loblaw_common (npm)
- Jun 20, 2022
Malicious code in ifit-actions (npm)
- Jun 20, 2022
Malicious code in gme-loblawsinc (npm)
- Jun 20, 2022
Malicious code in fed-challenge-starter (npm)
- Jun 20, 2022
Malware in loblaw_common
1 compromised version
- Jun 20, 2022
Malware in ifit-actions
1 compromised version
- Jun 20, 2022
Malware in gme-loblawsinc
1 compromised version
- Jun 20, 2022
Malware in fed-challenge-starter
1 compromised version
- Jun 20, 2022
Malicious code in wm-prelib-builder (npm)
- Jun 20, 2022
Malicious code in loblaws-mkt-bundle (npm)
- Jun 20, 2022
Malicious code in loblaws-mkt (npm)
- Jun 20, 2022
Malicious code in config-monorepo (npm)
- Jun 20, 2022
Malware in loblaws-mkt
1 compromised version
- Jun 20, 2022
Malware in loblaws-mkt-bundle
1 compromised version
- Jun 20, 2022
Malware in config-monorepo
1 compromised version
- Jun 20, 2022
Malware in wm-prelib-builder
1 compromised version
- Jun 20, 2022
Malicious code in wm-package-json-validate (npm)
Page 4876 of 5,078