Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,168 total in npm · sorted newest first- Jun 20, 2022
Malicious code in mailjet-react-components (npm)
- Jun 20, 2022
Malicious code in mailjet-old-react-components (npm)
- Jun 20, 2022
Malware in mailjet-old-react-components
1 compromised version
- Jun 20, 2022
Malware in web-pubsub
1 compromised version
- Jun 20, 2022
Malware in mailjet-react-components
1 compromised version
- Jun 20, 2022
Malware in web-pubsub-express
1 compromised version
- Jun 20, 2022
Malicious code in node-cron-master1 (npm)
- Jun 20, 2022
Malicious code in node-cron-master (npm)
- Jun 20, 2022
Malicious code in epic-ue-themes-la (npm)
- Jun 20, 2022
Malicious code in discord-sniper (npm)
- Jun 20, 2022
Malicious code in cron-guru (npm)
- Jun 20, 2022
Malware in discord-sniper
1 compromised version
- Jun 20, 2022
Malware in node-cron-master1
1 compromised version
- Jun 20, 2022
Malware in cron-guru
1 compromised version
- Jun 20, 2022
Malware in epic-ue-themes-la
1 compromised version
- Jun 20, 2022
Malware in node-cron-master
1 compromised version
- Jun 20, 2022
Malicious code in test-credential (npm)
- Jun 20, 2022
Malicious code in synapse-access-control-1 (npm)
- Jun 20, 2022
Malicious code in shitshit2 (npm)
- Jun 20, 2022
Malware in shitshit2
1 compromised version
- Jun 20, 2022
Malware in synapse-access-control-1
1 compromised version
- Jun 20, 2022
Malware in test-credential
1 compromised version
- Jun 20, 2022
Malicious code in shitshit1 (npm)
- Jun 20, 2022
Malware in shitshit1
1 compromised version
- Jun 20, 2022
Malicious code in shitshit12 (npm)
- Jun 20, 2022
Malicious code in fstreamlalala (npm)
- Jun 20, 2022
Malicious code in fstream-pirlalala (npm)
- Jun 20, 2022
Malicious code in fstream-package-2 (npm)
- Jun 20, 2022
Malware in fstreamlalala
1 compromised version
- Jun 20, 2022
Malware in fstream-pirlalala
1 compromised version
- Jun 20, 2022
Malware in fstream-package-2
1 compromised version
- Jun 20, 2022
Malware in shitshit12
1 compromised version
- Jun 20, 2022
Malicious code in kakakaakaaa11aaa3_returns_hello_jfrog2a (npm)
- Jun 20, 2022
Malicious code in kakakaakaaa11aaa3_returns_hello_jfrog2 (npm)
- Jun 20, 2022
Malicious code in azure-template-cpp (npm)
- Jun 20, 2022
Malicious code in azure-container-registry-samples-ts (npm)
- Jun 20, 2022
Malicious code in azure-container-registry-samples-js (npm)
- Jun 20, 2022
Malware in kakakaakaaa11aaa3_returns_hello_jfrog2a
1 compromised version
- Jun 20, 2022
Malware in azure-template-cpp
1 compromised version
- Jun 20, 2022
Malware in kakakaakaaa11aaa3_returns_hello_jfrog2
1 compromised version
- Jun 20, 2022
Malware in azure-container-registry-samples-ts
1 compromised version
- Jun 20, 2022
Malware in azure-container-registry-samples-js
1 compromised version
- Jun 20, 2022
Malicious code in jobspecification (npm)
- Jun 20, 2022
Malicious code in iotc-migrator (npm)
- Jun 20, 2022
Malicious code in cloudjob (npm)
- Jun 20, 2022
Malicious code in azure-storage-common-cpp (npm)
- Jun 20, 2022
Malware in cloudjob
1 compromised version
- Jun 20, 2022
Malware in iotc-migrator
1 compromised version
- Jun 20, 2022
Malware in azure-storage-common-cpp
1 compromised version
- Jun 20, 2022
Malware in jobspecification
1 compromised version
Page 4914 of 4,964