Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,608 total in npm · sorted newest first- Jun 20, 2022
Malware in console-less-variables
1 compromised version
- Jun 20, 2022
Malware in blz-internal-pkg
1 compromised version
- Jun 20, 2022
Malicious code in satreg-bits (npm)
- Jun 20, 2022
Malicious code in personal-info (npm)
- Jun 20, 2022
Malicious code in kastjs (npm)
- Jun 20, 2022
Malicious code in buffer-fetch (npm)
- Jun 20, 2022
Malware in satreg-bits
1 compromised version
- Jun 20, 2022
Malware in personal-info
1 compromised version
- Jun 20, 2022
Malware in buffer-fetch
1 compromised version
- Jun 20, 2022
Malware in kastjs
1 compromised version
- Jun 20, 2022
Malicious code in wg5 (npm)
- Jun 20, 2022
Malicious code in site-vue (npm)
- Jun 20, 2022
Malicious code in multisig-tool (npm)
- Jun 20, 2022
Malicious code in mbed-drivers (npm)
- Jun 20, 2022
Malware in multisig-tool
1 compromised version
- Jun 20, 2022
Malware in site-vue
1 compromised version
- Jun 20, 2022
Malware in mbed-drivers
1 compromised version
- Jun 20, 2022
Malware in wg5
1 compromised version
- Jun 20, 2022
Malicious code in vgs-staging (npm)
- Jun 20, 2022
Malicious code in vgs-auth (npm)
- Jun 20, 2022
Malicious code in kakakaakaaa (npm)
- Jun 20, 2022
Malicious code in kakakaaka (npm)
- Jun 20, 2022
Malware in vgs-auth
1 compromised version
- Jun 20, 2022
Malware in kakakaakaaa
1 compromised version
- Jun 20, 2022
Malware in vgs-staging
1 compromised version
- Jun 20, 2022
Malware in kakakaaka
1 compromised version
- Jun 20, 2022
Malicious code in swisspost-intranet-header (npm)
- Jun 20, 2022
Malicious code in os-wallet-provider (npm)
- Jun 20, 2022
Malicious code in ghs-payments (npm)
- Jun 20, 2022
Malicious code in ethos-design-system (npm)
- Jun 20, 2022
Malicious code in cp874-utf8 (npm)
- Jun 20, 2022
Malware in swisspost-intranet-header
1 compromised version
- Jun 20, 2022
Malware in ghs-payments
1 compromised version
- Jun 20, 2022
Malware in ethos-design-system
1 compromised version
- Jun 20, 2022
Malware in os-wallet-provider
1 compromised version
- Jun 20, 2022
Malware in cp874-utf8
1 compromised version
- Jun 20, 2022
Malicious code in buffer-refresh (npm)
- Jun 20, 2022
Malicious code in buffer--leep (npm)
- Jun 20, 2022
Malicious code in async-problem (npm)
- Jun 20, 2022
Malware in buffer-refresh
1 compromised version
- Jun 20, 2022
Malware in buffer--leep
1 compromised version
- Jun 20, 2022
Malware in async-problem
1 compromised version
- Jun 20, 2022
Malicious code in goprocess (npm)
- Jun 20, 2022
Malware in goprocess
1 compromised version
- Jun 20, 2022
Malicious code in vvs-uikit (npm)
- Jun 20, 2022
Malicious code in vvs-eslint-config (npm)
- Jun 20, 2022
Malicious code in sal-stack-lwip (npm)
- Jun 20, 2022
Malicious code in move-analyzer (npm)
- Jun 20, 2022
Malware in sal-stack-lwip
1 compromised version
- Jun 20, 2022
Malware in move-analyzer
1 compromised version
Page 4897 of 4,973