Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,729 total in npm · sorted newest first- Jun 20, 2022
Malware in gatsby-remark-gifplayer-transformer
1 compromised version
- Jun 20, 2022
Malware in zoe-sketchbook
1 compromised version
- Jun 20, 2022
Malicious code in yarn-design-system-react-select (npm)
- Jun 20, 2022
Malicious code in yarn-design-system-flatpickr (npm)
- Jun 20, 2022
Malicious code in yarn-design-system-choicesjs-stencil (npm)
- Jun 20, 2022
Malicious code in fetchspec (npm)
- Jun 20, 2022
Malware in fetchspec
1 compromised version
- Jun 20, 2022
Malware in yarn-design-system-flatpickr
1 compromised version
- Jun 20, 2022
Malware in yarn-design-system-react-select
1 compromised version
- Jun 20, 2022
Malware in yarn-design-system-choicesjs-stencil
1 compromised version
- Jun 20, 2022
Malicious code in yarn-design-system-rc-tooltip (npm)
- Jun 20, 2022
Malicious code in yarn-design-system-rc-input-number (npm)
- Jun 20, 2022
Malicious code in yarn-design-system-fonts (npm)
- Jun 20, 2022
Malware in yarn-design-system-rc-input-number
1 compromised version
- Jun 20, 2022
Malware in yarn-design-system-rc-tooltip
1 compromised version
- Jun 20, 2022
Malware in yarn-design-system-fonts
1 compromised version
- Jun 20, 2022
Malicious code in @twitch-easymode/twitch-security (npm)
- Jun 20, 2022
Malicious code in @twitch-easymode/endpoint-service-loadbalancer (npm)
- Jun 20, 2022
Malicious code in @twitch-easymode/capacity-planning (npm)
- Jun 20, 2022
Malicious code in @igdb/razzler (npm)
- Jun 20, 2022
Malicious code in @igdb/internal-api (npm)
- Jun 20, 2022
Malware in @twitch-easymode/endpoint-service-loadbalancer
1 compromised version
- Jun 20, 2022
Malware in @igdb/razzler
1 compromised version
- Jun 20, 2022
Malware in @twitch-easymode/capacity-planning
1 compromised version
- Jun 20, 2022
Malware in @igdb/internal-api
1 compromised version
- Jun 20, 2022
Malware in @twitch-easymode/twitch-security
1 compromised version
- Jun 20, 2022
Malicious code in twitch-intl-cli (npm)
- Jun 20, 2022
Malicious code in tachyon-utils-twitch (npm)
- Jun 20, 2022
Malicious code in tachyon-utils (npm)
- Jun 20, 2022
Malicious code in tachyon-package-builder (npm)
- Jun 20, 2022
Malware in tachyon-package-builder
1 compromised version
- Jun 20, 2022
Malware in twitch-intl-cli
1 compromised version
- Jun 20, 2022
Malware in tachyon-utils-twitch
1 compromised version
- Jun 20, 2022
Malware in tachyon-utils
1 compromised version
- Jun 20, 2022
Malicious code in twitch-integrations (npm)
- Jun 20, 2022
Malicious code in twitch-desktop-ipc (npm)
- Jun 20, 2022
Malicious code in twitch-desktop-components (npm)
- Jun 20, 2022
Malicious code in discovery-cdk-tools (npm)
- Jun 20, 2022
Malware in twitch-desktop-ipc
1 compromised version
- Jun 20, 2022
Malware in twitch-integrations
1 compromised version
- Jun 20, 2022
Malware in discovery-cdk-tools
1 compromised version
- Jun 20, 2022
Malware in twitch-desktop-components
1 compromised version
- Jun 20, 2022
Malicious code in amazon-ivs-web-broadcasting-sdk (npm)
- Jun 20, 2022
Malicious code in vagrant-s3-cdk (npm)
- Jun 20, 2022
Malicious code in twinit-cdk (npm)
- Jun 20, 2022
Malicious code in orko-web (npm)
- Jun 20, 2022
Malware in twinit-cdk
1 compromised version
- Jun 20, 2022
Malware in amazon-ivs-web-broadcasting-sdk
1 compromised version
- Jun 20, 2022
Malware in orko-web
1 compromised version
- Jun 20, 2022
Malware in vagrant-s3-cdk
1 compromised version
Page 4883 of 4,975