Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,608 total in npm · sorted newest first- Jun 20, 2022
Malware in vvs-uikit
1 compromised version
- Jun 20, 2022
Malware in vvs-eslint-config
1 compromised version
- Jun 20, 2022
Malicious code in opera-toolkit (npm)
- Jun 20, 2022
Malicious code in jet-client (npm)
- Jun 20, 2022
Malicious code in identity-module-miniapp (npm)
- Jun 20, 2022
Malicious code in @infra-node/kconf (npm)
- Jun 20, 2022
Malware in @infra-node/kconf
1 compromised version
- Jun 20, 2022
Malware in identity-module-miniapp
1 compromised version
- Jun 20, 2022
Malware in opera-toolkit
1 compromised version
- Jun 20, 2022
Malware in jet-client
1 compromised version
- Jun 20, 2022
Malicious code in vizceral-component (npm)
- Jun 20, 2022
Malicious code in twilio-chat-console-webapp.js (npm)
- Jun 20, 2022
Malicious code in twilio-chat-console-webapp (npm)
- Jun 20, 2022
Malicious code in pseudo-loc-for-signin-widget (npm)
- Jun 20, 2022
Malware in pseudo-loc-for-signin-widget
1 compromised version
- Jun 20, 2022
Malware in vizceral-component
1 compromised version
- Jun 20, 2022
Malware in twilio-chat-console-webapp
1 compromised version
- Jun 20, 2022
Malware in twilio-chat-console-webapp.js
1 compromised version
- Jun 20, 2022
Malicious code in woofi_swap (npm)
- Jun 20, 2022
Malicious code in server_qa_automation (npm)
- Jun 20, 2022
Malicious code in pcatalogweb (npm)
- Jun 20, 2022
Malicious code in courage-for-signin-widget (npm)
- Jun 20, 2022
Malware in pcatalogweb
1 compromised version
- Jun 20, 2022
Malware in server_qa_automation
1 compromised version
- Jun 20, 2022
Malware in courage-for-signin-widget
1 compromised version
- Jun 20, 2022
Malware in woofi_swap
1 compromised version
- Jun 20, 2022
Malicious code in @feis-component/dialog-manager (npm)
- Jun 20, 2022
Malicious code in domestic-market-bundle (npm)
- Jun 20, 2022
Malicious code in deneuve-test-2 (npm)
- Jun 20, 2022
Malware in @feis-component/dialog-manager
1 compromised version
- Jun 20, 2022
Malware in domestic-market-bundle
1 compromised version
- Jun 20, 2022
Malware in deneuve-test-2
1 compromised version
- Jun 20, 2022
Malicious code in @kindred-feature/deposit-limits (npm)
- Jun 20, 2022
Malicious code in @kindred-brand/unibet (npm)
- Jun 20, 2022
Malicious code in generator-juicebox (npm)
- Jun 20, 2022
Malicious code in @feis-vanilla/vanilla-util (npm)
- Jun 20, 2022
Malicious code in @feis-vanilla/cms-intl (npm)
- Jun 20, 2022
Malware in @kindred-feature/deposit-limits
1 compromised version
- Jun 20, 2022
Malware in generator-juicebox
1 compromised version
- Jun 20, 2022
Malware in @feis-vanilla/cms-intl
1 compromised version
- Jun 20, 2022
Malware in @feis-vanilla/vanilla-util
1 compromised version
- Jun 20, 2022
Malware in @kindred-brand/unibet
1 compromised version
- Jun 20, 2022
Malicious code in p224 (npm)
- Jun 20, 2022
Malicious code in feature-gating (npm)
- Jun 20, 2022
Malicious code in byted-tma-pack (npm)
- Jun 20, 2022
Malware in byted-tma-pack
1 compromised version
- Jun 20, 2022
Malware in feature-gating
1 compromised version
- Jun 20, 2022
Malware in p224
1 compromised version
- Jun 20, 2022
Malicious code in yelp_page_complete (npm)
- Jun 20, 2022
Malicious code in event-bus-xp (npm)
Page 4898 of 4,973