Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,842 total in npm · sorted newest first- Jun 20, 2022
Malicious code in ember-qunit-notifications (npm)
- Jun 20, 2022
Malicious code in dustjs-linkedin-helpers (npm)
- Jun 20, 2022
Malware in dustjs-linkedin-helpers
1 compromised version
- Jun 20, 2022
Malware in ember-qunit-notifications
1 compromised version
- Jun 20, 2022
Malware in smartcontractkit
1 compromised version
- Jun 20, 2022
Malware in @pancakeswap-lib/sdk
1 compromised version
- Jun 20, 2022
Malware in vue3-infinite-scroll
1 compromised version
- Jun 20, 2022
Malicious code in tinkoff-web-tracking (npm)
- Jun 20, 2022
Malicious code in fin-common-snapshot (npm)
- Jun 20, 2022
Malicious code in codefest-internal-package (npm)
- Jun 20, 2022
Malicious code in codefest-internal-dependency (npm)
- Jun 20, 2022
Malicious code in appsec-internal-package (npm)
- Jun 20, 2022
Malware in appsec-internal-package
1 compromised version
- Jun 20, 2022
Malware in fin-common-snapshot
1 compromised version
- Jun 20, 2022
Malware in codefest-internal-dependency
1 compromised version
- Jun 20, 2022
Malware in codefest-internal-package
1 compromised version
- Jun 20, 2022
Malware in tinkoff-web-tracking
1 compromised version
- Jun 20, 2022
Malicious code in wof-prompter (npm)
- Jun 20, 2022
Malicious code in kleros-escrow (npm)
- Jun 20, 2022
Malicious code in caindemonode (npm)
- Jun 20, 2022
Malware in kleros-escrow
1 compromised version
- Jun 20, 2022
Malware in wof-prompter
1 compromised version
- Jun 20, 2022
Malware in caindemonode
1 compromised version
- Jun 20, 2022
Malicious code in xss-finder-0xsapra (npm)
- Jun 20, 2022
Malicious code in taf-three-dimensional-view (npm)
- Jun 20, 2022
Malware in taf-three-dimensional-view
1 compromised version
- Jun 20, 2022
Malware in xss-finder-0xsapra
1 compromised version
- Jun 20, 2022
Malicious code in asset-detect-filter (npm)
- Jun 20, 2022
Malware in asset-detect-filter
1 compromised version
- Jun 20, 2022
Malicious code in ucs-tooltip (npm)
- Jun 20, 2022
Malicious code in noblox.js-proxy (npm)
- Jun 20, 2022
Malicious code in fe-cookie-consent (npm)
- Jun 20, 2022
Malicious code in asset-detect-layout (npm)
- Jun 20, 2022
Malware in asset-detect-layout
1 compromised version
- Jun 20, 2022
Malware in fe-cookie-consent
1 compromised version
- Jun 20, 2022
Malware in ucs-tooltip
1 compromised version
- Jun 20, 2022
Malware in noblox.js-proxy
1 compromised version
- Jun 20, 2022
Malicious code in here_lead_generation_v2 (npm)
- Jun 20, 2022
Malicious code in here_cta_marketo_v2 (npm)
- Jun 20, 2022
Malicious code in here_base_theme_v2 (npm)
- Jun 20, 2022
Malicious code in here_base (npm)
- Jun 20, 2022
Malware in here_base
1 compromised version
- Jun 20, 2022
Malware in here_lead_generation_v2
1 compromised version
- Jun 20, 2022
Malware in here_base_theme_v2
1 compromised version
- Jun 20, 2022
Malware in here_cta_marketo_v2
1 compromised version
- Jun 20, 2022
Malicious code in uitk-react-icons (npm)
- Jun 20, 2022
Malicious code in uitk-react-cards (npm)
- Jun 20, 2022
Malicious code in tilled-api-client (npm)
- Jun 20, 2022
Malicious code in danafonts (npm)
- Jun 20, 2022
Malware in danafonts
1 compromised version
Page 4879 of 5,077