Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,725 total in npm · sorted newest first- Jun 20, 2022
Malicious code in shared-library-webpack-plugin (npm)
- Jun 20, 2022
Malicious code in @otvetmailru/exp-id-tools (npm)
- Jun 20, 2022
Malware in x-road-tech-radar
1 compromised version
- Jun 20, 2022
Malware in @otvetmailru/exp-id-tools
1 compromised version
- Jun 20, 2022
Malware in vc-modules
1 compromised version
- Jun 20, 2022
Malware in shared-library-webpack-plugin
1 compromised version
- Jun 20, 2022
Malicious code in whitesourcepublisher (npm)
- Jun 20, 2022
Malicious code in hitta-partner-controls (npm)
- Jun 20, 2022
Malicious code in bitski-js (npm)
- Jun 20, 2022
Malicious code in belvo-integration-api (npm)
- Jun 20, 2022
Malware in bitski-js
1 compromised version
- Jun 20, 2022
Malware in hitta-partner-controls
1 compromised version
- Jun 20, 2022
Malware in whitesourcepublisher
1 compromised version
- Jun 20, 2022
Malware in belvo-integration-api
1 compromised version
- Jun 20, 2022
Malicious code in reveal-js-multiplex (npm)
- Jun 20, 2022
Malicious code in polymesh-scripts (npm)
- Jun 20, 2022
Malicious code in polymesh-docs (npm)
- Jun 20, 2022
Malicious code in polymesh-cli (npm)
- Jun 20, 2022
Malicious code in countdown-context (npm)
- Jun 20, 2022
Malware in polymesh-docs
1 compromised version
- Jun 20, 2022
Malware in polymesh-scripts
1 compromised version
- Jun 20, 2022
Malware in polymesh-cli
1 compromised version
- Jun 20, 2022
Malware in reveal-js-multiplex
1 compromised version
- Jun 20, 2022
Malware in countdown-context
1 compromised version
- Jun 20, 2022
Malicious code in ping-on-pr (npm)
- Jun 20, 2022
Malicious code in patreon-examples (npm)
- Jun 20, 2022
Malicious code in ginnyinanpm (npm)
- Jun 20, 2022
Malware in ginnyinanpm
1 compromised version
- Jun 20, 2022
Malware in patreon-examples
1 compromised version
- Jun 20, 2022
Malware in ping-on-pr
1 compromised version
- Jun 20, 2022
Malicious code in workpentestvirus (npm)
- Jun 20, 2022
Malicious code in serverless-yandex-cloud-template (npm)
- Jun 20, 2022
Malicious code in selfbotdiv (npm)
- Jun 20, 2022
Malicious code in parrot-skill (npm)
- Jun 20, 2022
Malicious code in @omega-tracker/omg-abstract-strategy-plugin (npm)
- Jun 20, 2022
Malicious code in ml-handbook (npm)
- Jun 20, 2022
Malicious code in miniapp-api (npm)
- Jun 20, 2022
Malicious code in mimlofy-creator (npm)
- Jun 20, 2022
Malicious code in discordcod (npm)
- Jun 20, 2022
Malware in ml-handbook
1 compromised version
- Jun 20, 2022
Malware in miniapp-api
1 compromised version
- Jun 20, 2022
Malware in selfbotdiv
1 compromised version
- Jun 20, 2022
Malware in serverless-yandex-cloud-template
1 compromised version
- Jun 20, 2022
Malware in mimlofy-creator
1 compromised version
- Jun 20, 2022
Malware in parrot-skill
1 compromised version
- Jun 20, 2022
Malware in discordcod
1 compromised version
- Jun 20, 2022
Malware in @omega-tracker/omg-abstract-strategy-plugin
1 compromised version
- Jun 20, 2022
Malware in workpentestvirus
1 compromised version
- Jun 20, 2022
Malicious code in nginx-data-transfer-parser (npm)
- Jun 20, 2022
Malicious code in ember-sample (npm)
Page 4887 of 4,975