Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,725 total in npm · sorted newest first- Jun 20, 2022
Malicious code in commit-changes (npm)
- Jun 20, 2022
Malicious code in argocd-diff-action (npm)
- Jun 20, 2022
Malware in argocd-diff-action
1 compromised version
- Jun 20, 2022
Malware in commit-changes
1 compromised version
- Jun 20, 2022
Malware in nginx-data-transfer-parser
1 compromised version
- Jun 20, 2022
Malware in ember-sample
1 compromised version
- Jun 20, 2022
Malicious code in selfservicedesk-client (npm)
- Jun 20, 2022
Malicious code in basubanakar (npm)
- Jun 20, 2022
Malware in basubanakar
1 compromised version
- Jun 20, 2022
Malware in selfservicedesk-client
1 compromised version
- Jun 20, 2022
Malicious code in sentiance-firehose (npm)
- Jun 20, 2022
Malware in sentiance-firehose
1 compromised version
- Jun 20, 2022
Malicious code in scratch-desktop (npm)
- Jun 20, 2022
Malicious code in krew-installer (npm)
- Jun 20, 2022
Malicious code in is-pure (npm)
- Jun 20, 2022
Malicious code in bitwarden-web (npm)
- Jun 20, 2022
Malware in is-pure
1 compromised version
- Jun 20, 2022
Malware in bitwarden-web
1 compromised version
- Jun 20, 2022
Malware in krew-installer
1 compromised version
- Jun 20, 2022
Malware in scratch-desktop
1 compromised version
- Jun 20, 2022
Malicious code in vk-apps-contacts (npm)
- Jun 20, 2022
Malicious code in testingpp (npm)
- Jun 20, 2022
Malicious code in statusim-mobile (npm)
- Jun 20, 2022
Malicious code in stacks-wallet (npm)
- Jun 20, 2022
Malicious code in binary-static (npm)
- Jun 20, 2022
Malware in binary-static
1 compromised version
- Jun 20, 2022
Malware in testingpp
1 compromised version
- Jun 20, 2022
Malware in vk-apps-contacts
1 compromised version
- Jun 20, 2022
Malware in statusim-mobile
1 compromised version
- Jun 20, 2022
Malware in stacks-wallet
1 compromised version
- Jun 20, 2022
Malicious code in @slashkit/core (npm)
- Jun 20, 2022
Malicious code in pancake_uniswap_validators_utils (npm)
- Jun 20, 2022
Malicious code in @maui-mf/common-env (npm)
- Jun 20, 2022
Malicious code in @maui-mf/app-auth (npm)
- Jun 20, 2022
Malicious code in discord.js-beta (npm)
- Jun 20, 2022
Malware in @maui-mf/app-auth
1 compromised version
- Jun 20, 2022
Malware in discord.js-beta
1 compromised version
- Jun 20, 2022
Malware in @slashkit/core
1 compromised version
- Jun 20, 2022
Malware in @maui-mf/common-env
1 compromised version
- Jun 20, 2022
Malware in pancake_uniswap_validators_utils
1 compromised version
- Jun 20, 2022
Malicious code in @shared-ui/global-navigation-header (npm)
- Jun 20, 2022
Malware in @shared-ui/global-navigation-header
1 compromised version
- Jun 20, 2022
Malicious code in h98dxxx (npm)
- Jun 20, 2022
Malware in h98dxxx
1 compromised version
- Jun 20, 2022
Malicious code in phone_helpers (npm)
- Jun 20, 2022
Malicious code in hydrogen-playground (npm)
- Jun 20, 2022
Malicious code in h98dxx (npm)
- Jun 20, 2022
Malicious code in h98dx (npm)
- Jun 20, 2022
Malware in hydrogen-playground
1 compromised version
- Jun 20, 2022
Malware in phone_helpers
1 compromised version
Page 4888 of 4,975