Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,172 total in npm · sorted newest first- Jun 20, 2022
Malicious code in alphavantage-adapter (npm)
- Jun 20, 2022
Malicious code in alphachain-adapter (npm)
- Jun 20, 2022
Malicious code in ada-balance-adapter (npm)
- Jun 20, 2022
Malware in alphavantage-adapter
1 compromised version
- Jun 20, 2022
Malware in ada-balance-adapter
1 compromised version
- Jun 20, 2022
Malware in alphachain-adapter
1 compromised version
- Jun 20, 2022
Malicious code in accuweather-adapter (npm)
- Jun 20, 2022
Malicious code in xbto-adapter (npm)
- Jun 20, 2022
Malicious code in sample-npm-balu (npm)
- Jun 20, 2022
Malicious code in 1forge-adapter (npm)
- Jun 20, 2022
Malware in xbto-adapter
1 compromised version
- Jun 20, 2022
Malware in sample-npm-balu
1 compromised version
- Jun 20, 2022
Malware in accuweather-adapter
1 compromised version
- Jun 20, 2022
Malware in 1forge-adapter
1 compromised version
- Jun 20, 2022
Malicious code in visualization-raphael-chart (npm)
- Jun 20, 2022
Malicious code in gapminder-offline (npm)
- Jun 20, 2022
Malicious code in discord.js-selfbot-v7 (npm)
- Jun 20, 2022
Malicious code in discord.js-selfbot-v32 (npm)
- Jun 20, 2022
Malware in gapminder-offline
1 compromised version
- Jun 20, 2022
Malware in discord.js-selfbot-v7
1 compromised version
- Jun 20, 2022
Malware in visualization-raphael-chart
1 compromised version
- Jun 20, 2022
Malware in discord.js-selfbot-v32
1 compromised version
- Jun 20, 2022
Malicious code in alprazolamdiv (npm)
- Jun 20, 2022
Malicious code in labrujha-cadas (npm)
- Jun 20, 2022
Malicious code in discord.js-selfbot-cloner (npm)
- Jun 20, 2022
Malware in alprazolamdiv
1 compromised version
- Jun 20, 2022
Malware in labrujha-cadas
1 compromised version
- Jun 20, 2022
Malware in discord.js-selfbot-cloner
1 compromised version
- Jun 20, 2022
Malicious code in jetpack-connection (npm)
- Jun 20, 2022
Malicious code in jetpack-config (npm)
- Jun 20, 2022
Malicious code in jetpack-components (npm)
- Jun 20, 2022
Malicious code in jetpack-api (npm)
- Jun 20, 2022
Malicious code in galaxyy-lib (npm)
- Jun 20, 2022
Malware in jetpack-connection
1 compromised version
- Jun 20, 2022
Malware in galaxyy-lib
1 compromised version
- Jun 20, 2022
Malware in jetpack-components
1 compromised version
- Jun 20, 2022
Malware in jetpack-api
1 compromised version
- Jun 20, 2022
Malware in jetpack-config
1 compromised version
- Jun 20, 2022
Malicious code in pepinole (npm)
- Jun 20, 2022
Malicious code in pedrolinsisi (npm)
- Jun 20, 2022
Malicious code in pedrito (npm)
- Jun 20, 2022
Malicious code in gradient-stringnnnn (npm)
- Jun 20, 2022
Malware in pedrito
1 compromised version
- Jun 20, 2022
Malware in pedrolinsisi
1 compromised version
- Jun 20, 2022
Malware in gradient-stringnnnn
1 compromised version
- Jun 20, 2022
Malware in pepinole
1 compromised version
- Jun 20, 2022
Malicious code in rocky_testing_confusion (npm)
- Jun 20, 2022
Malicious code in gradient-stringss (npm)
- Jun 20, 2022
Malicious code in gradient-strings (npm)
- Jun 20, 2022
Malicious code in gradient-stringn (npm)
Page 4908 of 4,964