Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,842 total in npm · sorted newest first- Jun 20, 2022
Malware in commonweb-config
1 compromised version
- Jun 20, 2022
Malware in commonweb-dynamic-routing
1 compromised version
- Jun 20, 2022
Malware in cwpattern-lib-paypal
1 compromised version
- Jun 20, 2022
Malicious code in react-address-entry-field (npm)
- Jun 20, 2022
Malicious code in gtm-tracking-sdk (npm)
- Jun 20, 2022
Malicious code in aysa-web-core (npm)
- Jun 20, 2022
Malicious code in aysa-slugs (npm)
- Jun 20, 2022
Malware in aysa-web-core
1 compromised version
- Jun 20, 2022
Malware in react-address-entry-field
1 compromised version
- Jun 20, 2022
Malware in aysa-slugs
1 compromised version
- Jun 20, 2022
Malware in gtm-tracking-sdk
1 compromised version
- Jun 20, 2022
Malicious code in yahoo-react-input (npm)
- Jun 20, 2022
Malicious code in yahoo-react-formsy-input (npm)
- Jun 20, 2022
Malicious code in @medicare-tools/core (npm)
- Jun 20, 2022
Malicious code in epic-ue-ui (npm)
- Jun 20, 2022
Malware in @medicare-tools/core
1 compromised version
- Jun 20, 2022
Malware in yahoo-react-formsy-input
1 compromised version
- Jun 20, 2022
Malware in yahoo-react-input
1 compromised version
- Jun 20, 2022
Malware in epic-ue-ui
1 compromised version
- Jun 20, 2022
Malicious code in @riptano/helios (npm)
- Jun 20, 2022
Malicious code in medicare-common-js (npm)
- Jun 20, 2022
Malicious code in constant-unifi (npm)
- Jun 20, 2022
Malware in @riptano/helios
1 compromised version
- Jun 20, 2022
Malware in medicare-common-js
1 compromised version
- Jun 20, 2022
Malware in constant-unifi
1 compromised version
- Jun 20, 2022
Malicious code in @termly/react-components (npm)
- Jun 20, 2022
Malicious code in @sberid/qrcode (npm)
- Jun 20, 2022
Malicious code in @my-samokat/ui (npm)
- Jun 20, 2022
Malicious code in @my-samokat/icons (npm)
- Jun 20, 2022
Malware in @termly/react-components
1 compromised version
- Jun 20, 2022
Malware in @my-samokat/ui
1 compromised version
- Jun 20, 2022
Malware in @my-samokat/icons
1 compromised version
- Jun 20, 2022
Malware in @sberid/qrcode
1 compromised version
- Jun 20, 2022
Malicious code in abbsjshshs (npm)
- Jun 20, 2022
Malicious code in @zeos-libs/auth-client (npm)
- Jun 20, 2022
Malicious code in @timsuchanek/eb-test (npm)
- Jun 20, 2022
Malicious code in @sbtweb/chat-ui (npm)
- Jun 20, 2022
Malicious code in angular-directive-seed (npm)
- Jun 20, 2022
Malware in angular-directive-seed
1 compromised version
- Jun 20, 2022
Malware in @sbtweb/chat-ui
1 compromised version
- Jun 20, 2022
Malware in @timsuchanek/eb-test
1 compromised version
- Jun 20, 2022
Malware in @zeos-libs/auth-client
1 compromised version
- Jun 20, 2022
Malware in abbsjshshs
1 compromised version
- Jun 20, 2022
Malicious code in abunews-components (npm)
- Jun 20, 2022
Malicious code in abu-news-api (npm)
- Jun 20, 2022
Malicious code in ykeykey-setup (npm)
- Jun 20, 2022
Malicious code in luc1f3rhk1-test2 (npm)
- Jun 20, 2022
Malware in abu-news-api
1 compromised version
- Jun 20, 2022
Malware in ykeykey-setup
1 compromised version
- Jun 20, 2022
Malware in luc1f3rhk1-test2
1 compromised version
Page 4881 of 5,077