Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,168 total in npm · sorted newest first- Jun 20, 2022
Malicious code in string_decoder-browserify (npm)
- Jun 20, 2022
Malicious code in react-instantsearch-hooks-dom (npm)
- Jun 20, 2022
Malicious code in parcel-plugin-test (npm)
- Jun 20, 2022
Malicious code in other-item (npm)
- Jun 20, 2022
Malware in react-instantsearch-hooks-dom
1 compromised version
- Jun 20, 2022
Malware in other-item
1 compromised version
- Jun 20, 2022
Malware in string_decoder-browserify
1 compromised version
- Jun 20, 2022
Malware in parcel-plugin-test
1 compromised version
- Jun 20, 2022
Malicious code in yello133 (npm)
- Jun 20, 2022
Malicious code in pod-smartphone-api (npm)
- Jun 20, 2022
Malicious code in hacker1337 (npm)
- Jun 20, 2022
Malicious code in fbtoken (npm)
- Jun 20, 2022
Malware in yello133
1 compromised version
- Jun 20, 2022
Malware in fbtoken
1 compromised version
- Jun 20, 2022
Malware in hacker1337
1 compromised version
- Jun 20, 2022
Malware in pod-smartphone-api
1 compromised version
- Jun 20, 2022
Malicious code in pod-api-client (npm)
- Jun 20, 2022
Malicious code in kakaga (npm)
- Jun 20, 2022
Malicious code in dependency1337 (npm)
- Jun 20, 2022
Malicious code in dependency123 (npm)
- Jun 20, 2022
Malware in dependency123
1 compromised version
- Jun 20, 2022
Malware in dependency1337
1 compromised version
- Jun 20, 2022
Malware in pod-api-client
1 compromised version
- Jun 20, 2022
Malware in kakaga
1 compromised version
- Jun 20, 2022
Malicious code in wixdev2022-1 (npm)
- Jun 20, 2022
Malicious code in nocuzune (npm)
- Jun 20, 2022
Malicious code in grabbir (npm)
- Jun 20, 2022
Malicious code in colors2.0 (npm)
- Jun 20, 2022
Malware in nocuzune
1 compromised version
- Jun 20, 2022
Malware in grabbir
1 compromised version
- Jun 20, 2022
Malware in colors2.0
1 compromised version
- Jun 20, 2022
Malware in wixdev2022-1
1 compromised version
- Jun 20, 2022
Malicious code in actual-malware (npm)
- Jun 20, 2022
Malicious code in actma (npm)
- Jun 20, 2022
Malicious code in colorsss (npm)
- Jun 20, 2022
Malicious code in colors-3.0 (npm)
- Jun 20, 2022
Malware in actual-malware
1 compromised version
- Jun 20, 2022
Malware in actma
1 compromised version
- Jun 20, 2022
Malware in colors-3.0
1 compromised version
- Jun 20, 2022
Malware in colorsss
1 compromised version
- Jun 20, 2022
Malicious code in ai-document-translator (npm)
- Jun 20, 2022
Malicious code in agrifood-farming (npm)
- Jun 20, 2022
Malicious code in @roku-web-core/ajax (npm)
- Jun 20, 2022
Malicious code in arm-apimanagement (npm)
- Jun 20, 2022
Malicious code in arm-analysisservices (npm)
- Jun 20, 2022
Malware in @roku-web-core/ajax
1 compromised version
- Jun 20, 2022
Malware in ai-document-translator
1 compromised version
- Jun 20, 2022
Malware in arm-apimanagement
1 compromised version
- Jun 20, 2022
Malware in agrifood-farming
1 compromised version
- Jun 20, 2022
Malware in arm-analysisservices
1 compromised version
Page 4910 of 4,964