Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,725 total in npm · sorted newest first- Jun 20, 2022
Malicious code in yeoman-ui-frontend (npm)
- Jun 20, 2022
Malicious code in jfrog-svartalfheim (npm)
- Jun 20, 2022
Malicious code in datetime-moment-parser (npm)
- Jun 20, 2022
Malicious code in chaostest (npm)
- Jun 20, 2022
Malware in yeoman-ui-frontend
1 compromised version
- Jun 20, 2022
Malware in jfrog-svartalfheim
1 compromised version
- Jun 20, 2022
Malware in chaostest
1 compromised version
- Jun 20, 2022
Malware in datetime-moment-parser
1 compromised version
- Jun 20, 2022
Malicious code in react-dom-is (npm)
- Jun 20, 2022
Malicious code in grunt-contrib-jscs (npm)
- Jun 20, 2022
Malicious code in exporting-ref-project (npm)
- Jun 20, 2022
Malicious code in bb-babelfish (npm)
- Jun 20, 2022
Malware in bb-babelfish
1 compromised version
- Jun 20, 2022
Malware in exporting-ref-project
1 compromised version
- Jun 20, 2022
Malware in react-dom-is
1 compromised version
- Jun 20, 2022
Malware in grunt-contrib-jscs
1 compromised version
- Jun 20, 2022
Malicious code in @zohocalendar/color-picker (npm)
- Jun 20, 2022
Malicious code in wf-react-day-picker (npm)
- Jun 20, 2022
Malicious code in discord.js-latest (npm)
- Jun 20, 2022
Malicious code in didi-sdk (npm)
- Jun 20, 2022
Malware in wf-react-day-picker
1 compromised version
- Jun 20, 2022
Malware in discord.js-latest
1 compromised version
- Jun 20, 2022
Malware in @zohocalendar/color-picker
1 compromised version
- Jun 20, 2022
Malware in didi-sdk
1 compromised version
- Jun 20, 2022
Malicious code in @zohocalendar/resource-loader (npm)
- Jun 20, 2022
Malicious code in @zohocalendar/date-picker (npm)
- Jun 20, 2022
Malicious code in react-intl-next (npm)
- Jun 20, 2022
Malicious code in convert-to-asyncawait (npm)
- Jun 20, 2022
Malware in convert-to-asyncawait
1 compromised version
- Jun 20, 2022
Malware in @zohocalendar/date-picker
1 compromised version
- Jun 20, 2022
Malware in @zohocalendar/resource-loader
1 compromised version
- Jun 20, 2022
Malware in react-intl-next
1 compromised version
- Jun 20, 2022
Malicious code in @aznb/extension-gather (npm)
- Jun 20, 2022
Malicious code in typescript3 (npm)
- Jun 20, 2022
Malicious code in czar-package9-npm (npm)
- Jun 20, 2022
Malicious code in @bmw-chris/common-default-frontend (npm)
- Jun 20, 2022
Malware in @aznb/extension-gather
1 compromised version
- Jun 20, 2022
Malware in typescript3
1 compromised version
- Jun 20, 2022
Malware in czar-package9-npm
1 compromised version
- Jun 20, 2022
Malware in @bmw-chris/common-default-frontend
1 compromised version
- Jun 20, 2022
Malicious code in @e-finance/e-finance-tms-analytics (npm)
- Jun 20, 2022
Malicious code in @bmw-chris/vehiclesession-default-frontend (npm)
- Jun 20, 2022
Malicious code in @bmw-chris/signalr-default-frontend (npm)
- Jun 20, 2022
Malicious code in @bmw-chris/onlinesession-default-frontend (npm)
- Jun 20, 2022
Malware in @bmw-chris/onlinesession-default-frontend
1 compromised version
- Jun 20, 2022
Malware in @bmw-chris/vehiclesession-default-frontend
1 compromised version
- Jun 20, 2022
Malware in @e-finance/e-finance-tms-analytics
1 compromised version
- Jun 20, 2022
Malware in @bmw-chris/signalr-default-frontend
1 compromised version
- Jun 20, 2022
Malicious code in @bmw-chris/testmodule-default-frontend (npm)
- Jun 20, 2022
Malicious code in @bmw-chris/ecufunction-default-frontend (npm)
Page 4891 of 4,975