Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,513 total in npm · sorted newest first- Jun 20, 2022
Malicious code in unresolved (npm)
- Jun 20, 2022
Malicious code in mbed-js-gulp (npm)
- Jun 20, 2022
Malicious code in c3p-test-reactnative (npm)
- Jun 20, 2022
Malware in angara.tablejs
1 compromised version
- Jun 20, 2022
Malware in mbed-js-gulp
1 compromised version
- Jun 20, 2022
Malware in unresolved
1 compromised version
- Jun 20, 2022
Malware in c3p-test-reactnative
1 compromised version
- Jun 20, 2022
Malicious code in angara.serializationjs (npm)
- Jun 20, 2022
Malicious code in angara.chartjs (npm)
- Jun 20, 2022
Malicious code in unodep (npm)
- Jun 20, 2022
Malicious code in test321 (npm)
- Jun 20, 2022
Malware in unodep
1 compromised version
- Jun 20, 2022
Malware in test321
1 compromised version
- Jun 20, 2022
Malware in angara.chartjs
1 compromised version
- Jun 20, 2022
Malware in angara.serializationjs
1 compromised version
- Jun 20, 2022
Malicious code in tresdepasdfasdf (npm)
- Jun 20, 2022
Malicious code in tresdep (npm)
- Jun 20, 2022
Malicious code in @immersive-composer/backend-resources-types (npm)
- Jun 20, 2022
Malicious code in dosdep (npm)
- Jun 20, 2022
Malware in @immersive-composer/backend-resources-types
1 compromised version
- Jun 20, 2022
Malware in tresdep
1 compromised version
- Jun 20, 2022
Malware in dosdep
1 compromised version
- Jun 20, 2022
Malware in tresdepasdfasdf
1 compromised version
- Jun 20, 2022
Malicious code in sonulindu (npm)
- Jun 20, 2022
Malicious code in markedjs (npm)
- Jun 20, 2022
Malicious code in @immersive-composer/scripting-api (npm)
- Jun 20, 2022
Malicious code in aploydiv (npm)
- Jun 20, 2022
Malicious code in aploybro (npm)
- Jun 20, 2022
Malware in sonulindu
1 compromised version
- Jun 20, 2022
Malware in aploybro
1 compromised version
- Jun 20, 2022
Malware in aploydiv
1 compromised version
- Jun 20, 2022
Malware in @immersive-composer/scripting-api
1 compromised version
- Jun 20, 2022
Malware in markedjs
1 compromised version
- Jun 20, 2022
Malicious code in discord.js-selfbot-aployscr (npm)
- Jun 20, 2022
Malicious code in discord.js-selfbot-aploys (npm)
- Jun 20, 2022
Malicious code in discord.js-selfbot-aployed (npm)
- Jun 20, 2022
Malicious code in discord.js-aployscript-v11 (npm)
- Jun 20, 2022
Malware in discord.js-selfbot-aployed
1 compromised version
- Jun 20, 2022
Malware in discord.js-selfbot-aploys
1 compromised version
- Jun 20, 2022
Malware in discord.js-selfbot-aployscr
1 compromised version
- Jun 20, 2022
Malware in discord.js-aployscript-v11
1 compromised version
- Jun 20, 2022
Malicious code in @qw-app/fonts (npm)
- Jun 20, 2022
Malicious code in discord.js-selfbot-aployscript (npm)
- Jun 20, 2022
Malicious code in discord.js-selfbot-aploy (npm)
- Jun 20, 2022
Malicious code in aployscript (npm)
- Jun 20, 2022
Malware in aployscript
1 compromised version
- Jun 20, 2022
Malware in discord.js-selfbot-aploy
1 compromised version
- Jun 20, 2022
Malware in discord.js-selfbot-aployscript
1 compromised version
- Jun 20, 2022
Malware in @qw-app/fonts
1 compromised version
- Jun 20, 2022
Malicious code in @qw-app/react (npm)
Page 4902 of 4,971