Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,721 total in npm · sorted newest first- Jun 20, 2022
Malware in @bmw-chris/case-default-frontend
1 compromised version
- Jun 20, 2022
Malware in @bmw-chris/document-default-frontend
1 compromised version
- Jun 20, 2022
Malicious code in @e-finance/e-finance-tms-components (npm)
- Jun 20, 2022
Malicious code in @bmw-ispi-workplace/iwplib (npm)
- Jun 20, 2022
Malicious code in @bmw-ispi-workplace/dms-impl (npm)
- Jun 20, 2022
Malicious code in @bmw-ispi-workplace/dms-api (npm)
- Jun 20, 2022
Malware in @e-finance/e-finance-tms-components
1 compromised version
- Jun 20, 2022
Malware in @bmw-ispi-workplace/dms-impl
1 compromised version
- Jun 20, 2022
Malware in @bmw-ispi-workplace/iwplib
1 compromised version
- Jun 20, 2022
Malware in @bmw-ispi-workplace/dms-api
1 compromised version
- Jun 20, 2022
Malicious code in @bmw-ispi-workplace/dms-common (npm)
- Jun 20, 2022
Malicious code in @bmw-chris/logger-default-frontend (npm)
- Jun 20, 2022
Malicious code in @bmw-chris/ecutree-default-frontend (npm)
- Jun 20, 2022
Malware in @bmw-chris/logger-default-frontend
1 compromised version
- Jun 20, 2022
Malware in @bmw-ispi-workplace/dms-common
1 compromised version
- Jun 20, 2022
Malware in @bmw-chris/ecutree-default-frontend
1 compromised version
- Jun 20, 2022
Malware in @bmw-ds/components
1 compromised version
- Jun 20, 2022
Malicious code in sam_jobs (npm)
- Jun 20, 2022
Malicious code in e-finance-tms-analytics (npm)
- Jun 20, 2022
Malicious code in chart.js-bar (npm)
- Jun 20, 2022
Malicious code in bmw-angular-framework (npm)
- Jun 20, 2022
Malware in chart.js-bar
1 compromised version
- Jun 20, 2022
Malware in sam_jobs
1 compromised version
- Jun 20, 2022
Malware in bmw-angular-framework
1 compromised version
- Jun 20, 2022
Malware in e-finance-tms-analytics
1 compromised version
- Jun 20, 2022
Malicious code in zoom-sdk-native-addon (npm)
- Jun 20, 2022
Malicious code in vscode-dependency-confusion (npm)
- Jun 20, 2022
Malicious code in fossa-dc (npm)
- Jun 20, 2022
Malicious code in dependency-confusion-fossa-example (npm)
- Jun 20, 2022
Malware in fossa-dc
1 compromised version
- Jun 20, 2022
Malware in zoom-sdk-native-addon
1 compromised version
- Jun 20, 2022
Malware in vscode-dependency-confusion
1 compromised version
- Jun 20, 2022
Malware in dependency-confusion-fossa-example
1 compromised version
- Jun 20, 2022
Malicious code in @tsers/core (npm)
- Jun 20, 2022
Malicious code in trello_v0-10-1 (npm)
- Jun 20, 2022
Malicious code in trello-0_10_1 (npm)
- Jun 20, 2022
Malicious code in rcv-desktop-sdk (npm)
- Jun 20, 2022
Malware in rcv-desktop-sdk
1 compromised version
- Jun 20, 2022
Malware in @tsers/core
1 compromised version
- Jun 20, 2022
Malware in trello_v0-10-1
1 compromised version
- Jun 20, 2022
Malware in trello-0_10_1
1 compromised version
- Jun 20, 2022
Malicious code in @tsers/react (npm)
- Jun 20, 2022
Malicious code in @crackle-fixtures/single-entry-library (npm)
- Jun 20, 2022
Malicious code in @crackle-fixtures/multi-entry-library (npm)
- Jun 20, 2022
Malicious code in @chargepoint/cp-toolkit (npm)
- Jun 20, 2022
Malware in @tsers/react
1 compromised version
- Jun 20, 2022
Malware in @chargepoint/cp-toolkit
1 compromised version
- Jun 20, 2022
Malware in @crackle-fixtures/multi-entry-library
1 compromised version
- Jun 20, 2022
Malware in @crackle-fixtures/single-entry-library
1 compromised version
- Jun 20, 2022
Malicious code in usage-metrics (npm)
Page 4892 of 4,975