Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,168 total in npm · sorted newest first- Jun 20, 2022
Malicious code in arm-appservice (npm)
- Jun 20, 2022
Malicious code in arm-appplatform (npm)
- Jun 20, 2022
Malicious code in arm-appinsights (npm)
- Jun 20, 2022
Malicious code in arm-appconfiguration (npm)
- Jun 20, 2022
Malware in arm-appplatform
1 compromised version
- Jun 20, 2022
Malware in arm-appconfiguration
1 compromised version
- Jun 20, 2022
Malware in arm-appinsights
1 compromised version
- Jun 20, 2022
Malware in arm-appservice
1 compromised version
- Jun 20, 2022
Malicious code in arm-sqlvirtualmachine (npm)
- Jun 20, 2022
Malicious code in arm-azurestackhci (npm)
- Jun 20, 2022
Malicious code in arm-azurestack (npm)
- Jun 20, 2022
Malicious code in arm-attestation (npm)
- Jun 20, 2022
Malware in arm-azurestackhci
1 compromised version
- Jun 20, 2022
Malware in arm-sqlvirtualmachine
1 compromised version
- Jun 20, 2022
Malware in arm-attestation
1 compromised version
- Jun 20, 2022
Malware in arm-azurestack
1 compromised version
- Jun 20, 2022
Malicious code in arm-storagesync (npm)
- Jun 20, 2022
Malicious code in arm-storageimportexport (npm)
- Jun 20, 2022
Malicious code in arm-storagecache (npm)
- Jun 20, 2022
Malicious code in arm-storage (npm)
- Jun 20, 2022
Malware in arm-storage
1 compromised version
- Jun 20, 2022
Malware in arm-storageimportexport
1 compromised version
- Jun 20, 2022
Malware in arm-storagecache
1 compromised version
- Jun 20, 2022
Malware in arm-storagesync
1 compromised version
- Jun 20, 2022
Malicious code in arm-subscriptions (npm)
- Jun 20, 2022
Malicious code in arm-streamanalytics (npm)
- Jun 20, 2022
Malicious code in arm-storsimple8000series (npm)
- Jun 20, 2022
Malicious code in arm-storsimple1200series (npm)
- Jun 20, 2022
Malware in arm-streamanalytics
1 compromised version
- Jun 20, 2022
Malware in arm-storsimple8000series
1 compromised version
- Jun 20, 2022
Malware in arm-storsimple1200series
1 compromised version
- Jun 20, 2022
Malware in arm-subscriptions
1 compromised version
- Jun 20, 2022
Malicious code in arm-timeseriesinsights (npm)
- Jun 20, 2022
Malicious code in arm-templatespecs (npm)
- Jun 20, 2022
Malicious code in arm-synapse (npm)
- Jun 20, 2022
Malicious code in arm-support (npm)
- Jun 20, 2022
Malware in arm-synapse
1 compromised version
- Jun 20, 2022
Malware in arm-timeseriesinsights
1 compromised version
- Jun 20, 2022
Malware in arm-support
1 compromised version
- Jun 20, 2022
Malware in arm-templatespecs
1 compromised version
- Jun 20, 2022
Malicious code in arm-vmwarecloudsimple (npm)
- Jun 20, 2022
Malicious code in arm-visualstudio (npm)
- Jun 20, 2022
Malicious code in arm-videoanalyzer (npm)
- Jun 20, 2022
Malicious code in arm-trafficmanager (npm)
- Jun 20, 2022
Malware in arm-videoanalyzer
1 compromised version
- Jun 20, 2022
Malware in arm-visualstudio
1 compromised version
- Jun 20, 2022
Malware in arm-vmwarecloudsimple
1 compromised version
- Jun 20, 2022
Malware in arm-trafficmanager
1 compromised version
- Jun 20, 2022
Malicious code in communication-common (npm)
- Jun 20, 2022
Malicious code in communication-chat (npm)
Page 4911 of 4,964