Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,505 total in npm · sorted newest first- Jun 20, 2022
Malware in wgversion
1 compromised version
- Jun 20, 2022
Malware in siteversion
1 compromised version
- Jun 20, 2022
Malware in three-d-secure
1 compromised version
- Jun 20, 2022
Malicious code in yelp-react-component-photo-box (npm)
- Jun 20, 2022
Malicious code in yelp-biz-action-constants (npm)
- Jun 20, 2022
Malicious code in yahoo-react-pillbox (npm)
- Jun 20, 2022
Malicious code in yahoo-react-multi-select-box (npm)
- Jun 20, 2022
Malware in yahoo-react-pillbox
1 compromised version
- Jun 20, 2022
Malware in yelp-react-component-photo-box
1 compromised version
- Jun 20, 2022
Malware in yelp-biz-action-constants
1 compromised version
- Jun 20, 2022
Malware in yahoo-react-multi-select-box
1 compromised version
- Jun 20, 2022
Malicious code in project-with-joe (npm)
- Jun 20, 2022
Malicious code in deps-json-webpack-plugin (npm)
- Jun 20, 2022
Malicious code in dellingr (npm)
- Jun 20, 2022
Malicious code in @bugbounty-automation/deps-json-webpack-plugin (npm)
- Jun 20, 2022
Malware in project-with-joe
1 compromised version
- Jun 20, 2022
Malware in deps-json-webpack-plugin
1 compromised version
- Jun 20, 2022
Malware in @bugbounty-automation/deps-json-webpack-plugin
1 compromised version
- Jun 20, 2022
Malware in dellingr
1 compromised version
- Jun 20, 2022
Malicious code in xnxx-dl-wa-bot (npm)
- Jun 20, 2022
Malicious code in vaccineforbharat (npm)
- Jun 20, 2022
Malicious code in ups_node (npm)
- Jun 20, 2022
Malicious code in ketcher (npm)
- Jun 20, 2022
Malicious code in exoduscore (npm)
- Jun 20, 2022
Malware in vaccineforbharat
1 compromised version
- Jun 20, 2022
Malware in xnxx-dl-wa-bot
1 compromised version
- Jun 20, 2022
Malware in exoduscore
1 compromised version
- Jun 20, 2022
Malware in ketcher
1 compromised version
- Jun 20, 2022
Malware in ups_node
1 compromised version
- Jun 20, 2022
Malicious code in yandex-money-currency-info (npm)
- Jun 20, 2022
Malicious code in yamoney-react-components (npm)
- Jun 20, 2022
Malicious code in yamoney-frontend-lib (npm)
- Jun 20, 2022
Malicious code in @btu-tools/mfe-feature-toggles (npm)
- Jun 20, 2022
Malware in yamoney-react-components
1 compromised version
- Jun 20, 2022
Malware in yamoney-frontend-lib
1 compromised version
- Jun 20, 2022
Malware in @btu-tools/mfe-feature-toggles
1 compromised version
- Jun 20, 2022
Malware in yandex-money-currency-info
1 compromised version
- Jun 20, 2022
Malicious code in @remove-bg/exif-js (npm)
- Jun 20, 2022
Malicious code in @btu-tools/master-builder-client (npm)
- Jun 20, 2022
Malicious code in atestofwhatmighthappenifwetypo (npm)
- Jun 20, 2022
Malware in @remove-bg/exif-js
1 compromised version
- Jun 20, 2022
Malware in @btu-tools/master-builder-client
1 compromised version
- Jun 20, 2022
Malware in atestofwhatmighthappenifwetypo
1 compromised version
- Jun 20, 2022
Malicious code in alicloud-core (npm)
- Jun 20, 2022
Malicious code in alicloud-base (npm)
- Jun 20, 2022
Malicious code in wechat-internal (npm)
- Jun 20, 2022
Malicious code in feishu-web-login (npm)
- Jun 20, 2022
Malicious code in feishu-qrcode-login (npm)
- Jun 20, 2022
Malware in feishu-qrcode-login
1 compromised version
- Jun 20, 2022
Malware in alicloud-base
1 compromised version
Page 4907 of 4,971