Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,842 total in npm · sorted newest first- Jun 20, 2022
Malware in abunews-components
1 compromised version
- Jun 20, 2022
Malicious code in acookie (npm)
- Jun 20, 2022
Malicious code in ykeykey-getkey (npm)
- Jun 20, 2022
Malicious code in noblox.js-proxies (npm)
- Jun 20, 2022
Malicious code in luc1f3rhk1-test (npm)
- Jun 20, 2022
Malware in ykeykey-getkey
1 compromised version
- Jun 20, 2022
Malware in luc1f3rhk1-test
1 compromised version
- Jun 20, 2022
Malware in acookie
1 compromised version
- Jun 20, 2022
Malware in noblox.js-proxies
1 compromised version
- Jun 20, 2022
Malicious code in @sdc-wob-type-3/group-ui (npm)
- Jun 20, 2022
Malicious code in dinesh-dev-nagajikkktest11223qa (npm)
- Jun 20, 2022
Malware in @sdc-wob-type-3/group-ui
1 compromised version
- Jun 20, 2022
Malware in dinesh-dev-nagajikkktest11223qa
1 compromised version
- Jun 20, 2022
Malicious code in mcs-landings-blocks (npm)
- Jun 20, 2022
Malicious code in mcs-landings-api (npm)
- Jun 20, 2022
Malicious code in lolo0093 (npm)
- Jun 20, 2022
Malware in lolo0093
1 compromised version
- Jun 20, 2022
Malware in mcs-landings-api
1 compromised version
- Jun 20, 2022
Malware in mcs-landings-blocks
1 compromised version
- Jun 20, 2022
Malicious code in mitek-science-mweb-sdk (npm)
- Jun 20, 2022
Malware in mitek-science-mweb-sdk
1 compromised version
- Jun 20, 2022
Malicious code in superset-websocket (npm)
- Jun 20, 2022
Malicious code in sifchain (npm)
- Jun 20, 2022
Malicious code in nethouse-ui (npm)
- Jun 20, 2022
Malicious code in nat-sdk-web (npm)
- Jun 20, 2022
Malware in superset-websocket
1 compromised version
- Jun 20, 2022
Malware in sifchain
1 compromised version
- Jun 20, 2022
Malware in nat-sdk-web
1 compromised version
- Jun 20, 2022
Malware in nethouse-ui
1 compromised version
- Jun 20, 2022
Malicious code in origami-registry-ui (npm)
- Jun 20, 2022
Malware in origami-registry-ui
1 compromised version
- Jun 20, 2022
Malicious code in how-to-mess-up (npm)
- Jun 20, 2022
Malware in how-to-mess-up
1 compromised version
- Jun 20, 2022
Malicious code in test1_l3yx (npm)
- Jun 20, 2022
Malicious code in @porting-assistant/react (npm)
- Jun 20, 2022
Malicious code in @porting-assistant/electron (npm)
- Jun 20, 2022
Malicious code in @porting-assistant/csharp (npm)
- Jun 20, 2022
Malware in @porting-assistant/electron
1 compromised version
- Jun 20, 2022
Malware in test1_l3yx
1 compromised version
- Jun 20, 2022
Malware in @porting-assistant/csharp
1 compromised version
- Jun 20, 2022
Malware in @porting-assistant/react
1 compromised version
- Jun 20, 2022
Malicious code in yelp-beans (npm)
- Jun 20, 2022
Malicious code in test4948 (npm)
- Jun 20, 2022
Malicious code in @porting-assistant/integration-test (npm)
- Jun 20, 2022
Malicious code in curiouscat (npm)
- Jun 20, 2022
Malware in @porting-assistant/integration-test
1 compromised version
- Jun 20, 2022
Malware in test4948
1 compromised version
- Jun 20, 2022
Malware in curiouscat
1 compromised version
- Jun 20, 2022
Malware in yelp-beans
1 compromised version
- Jun 20, 2022
Malicious code in paypay-sample-ecommerce-server (npm)
Page 4882 of 5,077