Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,846 total in npm · sorted newest first- Jun 20, 2022
Malware in kottestpackage
1 compromised version
- Jun 20, 2022
Malware in wp-scripts
1 compromised version
- Jun 20, 2022
Malware in npp-analytics
1 compromised version
- Jun 20, 2022
Malicious code in administracja_reklamowa (npm)
- Jun 20, 2022
Malicious code in wakacje-frontend-salki-neon (npm)
- Jun 20, 2022
Malicious code in wak-app (npm)
- Jun 20, 2022
Malicious code in pako-admin (npm)
- Jun 20, 2022
Malware in pako-admin
1 compromised version
- Jun 20, 2022
Malware in wak-app
1 compromised version
- Jun 20, 2022
Malware in wakacje-frontend-salki-neon
1 compromised version
- Jun 20, 2022
Malware in administracja_reklamowa
1 compromised version
- Jun 20, 2022
Malicious code in wpjslib (npm)
- Jun 20, 2022
Malicious code in peraichi (npm)
- Jun 20, 2022
Malicious code in opbox-build-tools (npm)
- Jun 20, 2022
Malicious code in kintro (npm)
- Jun 20, 2022
Malware in wpjslib
1 compromised version
- Jun 20, 2022
Malware in peraichi
1 compromised version
- Jun 20, 2022
Malware in opbox-build-tools
1 compromised version
- Jun 20, 2022
Malware in kintro
1 compromised version
- Jun 20, 2022
Malicious code in zalopay-payment-sdk (npm)
- Jun 20, 2022
Malicious code in web-portal (npm)
- Jun 20, 2022
Malicious code in com.unity.textmeshpro (npm)
- Jun 20, 2022
Malicious code in cart-client-js (npm)
- Jun 20, 2022
Malicious code in bc-modal (npm)
- Jun 20, 2022
Malware in cart-client-js
1 compromised version
- Jun 20, 2022
Malware in web-portal
1 compromised version
- Jun 20, 2022
Malware in com.unity.textmeshpro
1 compromised version
- Jun 20, 2022
Malware in bc-modal
1 compromised version
- Jun 20, 2022
Malware in zalopay-payment-sdk
1 compromised version
- Jun 20, 2022
Malicious code in ad-params (npm)
- Jun 20, 2022
Malicious code in shakademoassetinfo (npm)
- Jun 20, 2022
Malicious code in is-meta (npm)
- Jun 20, 2022
Malware in is-meta
1 compromised version
- Jun 20, 2022
Malware in shakademoassetinfo
1 compromised version
- Jun 20, 2022
Malware in ad-params
1 compromised version
- Jun 20, 2022
Malicious code in shared-sku-app (npm)
- Jun 20, 2022
Malicious code in load-date (npm)
- Jun 20, 2022
Malicious code in jugnnnnnuuuuu (npm)
- Jun 20, 2022
Malicious code in jekyll-tasks (npm)
- Jun 20, 2022
Malware in load-date
1 compromised version
- Jun 20, 2022
Malware in jugnnnnnuuuuu
1 compromised version
- Jun 20, 2022
Malware in jekyll-tasks
1 compromised version
- Jun 20, 2022
Malware in shared-sku-app
1 compromised version
- Jun 20, 2022
Malicious code in tokenizeutil (npm)
- Jun 20, 2022
Malicious code in token-registry-contracts (npm)
- Jun 20, 2022
Malicious code in rapidjson (npm)
- Jun 20, 2022
Malicious code in mock-jsx-module (npm)
- Jun 20, 2022
Malware in token-registry-contracts
1 compromised version
- Jun 20, 2022
Malware in mock-jsx-module
1 compromised version
- Jun 20, 2022
Malware in rapidjson
1 compromised version
Page 4878 of 5,077