Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,842 total in npm · sorted newest first- Jun 20, 2022
Malware in tilled-api-client
1 compromised version
- Jun 20, 2022
Malware in uitk-react-icons
1 compromised version
- Jun 20, 2022
Malware in uitk-react-cards
1 compromised version
- Jun 20, 2022
Malicious code in sport-components (npm)
- Jun 20, 2022
Malicious code in federalist-uswds-jekyll (npm)
- Jun 20, 2022
Malicious code in danalibs (npm)
- Jun 20, 2022
Malicious code in danaicons (npm)
- Jun 20, 2022
Malicious code in dana-desktop (npm)
- Jun 20, 2022
Malware in danalibs
1 compromised version
- Jun 20, 2022
Malware in federalist-uswds-jekyll
1 compromised version
- Jun 20, 2022
Malware in sport-components
1 compromised version
- Jun 20, 2022
Malware in danaicons
1 compromised version
- Jun 20, 2022
Malware in dana-desktop
1 compromised version
- Jun 20, 2022
Malicious code in vrt-mediaplayer (npm)
- Jun 20, 2022
Malicious code in upaya (npm)
- Jun 20, 2022
Malicious code in standup-bot (npm)
- Jun 20, 2022
Malicious code in nih-ncats-translator (npm)
- Jun 20, 2022
Malware in standup-bot
1 compromised version
- Jun 20, 2022
Malware in vrt-mediaplayer
1 compromised version
- Jun 20, 2022
Malware in upaya
1 compromised version
- Jun 20, 2022
Malware in nih-ncats-translator
1 compromised version
- Jun 20, 2022
Malicious code in sbirez (npm)
- Jun 20, 2022
Malicious code in fbopen-api (npm)
- Jun 20, 2022
Malicious code in 18f-dashboard (npm)
- Jun 20, 2022
Malicious code in beckley (npm)
- Jun 20, 2022
Malware in sbirez
1 compromised version
- Jun 20, 2022
Malware in beckley
1 compromised version
- Jun 20, 2022
Malware in fbopen-api
1 compromised version
- Jun 20, 2022
Malware in 18f-dashboard
1 compromised version
- Jun 20, 2022
Malicious code in vue-cumulio-dashboard (npm)
- Jun 20, 2022
Malicious code in k-paste (npm)
- Jun 20, 2022
Malicious code in hub-http (npm)
- Jun 20, 2022
Malicious code in hs-lodash (npm)
- Jun 20, 2022
Malware in hs-lodash
1 compromised version
- Jun 20, 2022
Malware in vue-cumulio-dashboard
1 compromised version
- Jun 20, 2022
Malware in hub-http
1 compromised version
- Jun 20, 2022
Malware in k-paste
1 compromised version
- Jun 20, 2022
Malicious code in adsinterceptor (npm)
- Jun 20, 2022
Malicious code in slack_beacon (npm)
- Jun 20, 2022
Malicious code in eurid_cloudflare (npm)
- Jun 20, 2022
Malicious code in commonweb-utils (npm)
- Jun 20, 2022
Malware in slack_beacon
1 compromised version
- Jun 20, 2022
Malware in adsinterceptor
1 compromised version
- Jun 20, 2022
Malware in eurid_cloudflare
1 compromised version
- Jun 20, 2022
Malware in commonweb-utils
1 compromised version
- Jun 20, 2022
Malicious code in cwpattern-lib-paypal (npm)
- Jun 20, 2022
Malicious code in consumerweb-analytics (npm)
- Jun 20, 2022
Malicious code in commonweb-dynamic-routing (npm)
- Jun 20, 2022
Malicious code in commonweb-config (npm)
- Jun 20, 2022
Malware in consumerweb-analytics
1 compromised version
Page 4880 of 5,077