Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,145 total in npm · sorted newest first- Jun 20, 2022
Malware in ing-feat-view-cancel-payments
1 compromised version
- Jun 20, 2022
Malware in lx-cockpit-components-loader
1 compromised version
- Jun 20, 2022
Malware in pattern-middleware
1 compromised version
- Jun 20, 2022
Malicious code in all-digital (npm)
- Jun 20, 2022
Malicious code in gd-react-toolbox (npm)
- Jun 20, 2022
Malicious code in gd-gplus (npm)
- Jun 20, 2022
Malicious code in azure-filter-3 (npm)
- Jun 20, 2022
Malware in gd-react-toolbox
1 compromised version
- Jun 20, 2022
Malware in azure-filter-3
1 compromised version
- Jun 20, 2022
Malware in gd-gplus
1 compromised version
- Jun 20, 2022
Malware in all-digital
1 compromised version
- Jun 20, 2022
Malicious code in media-server-embed (npm)
- Jun 20, 2022
Malicious code in lorawan-devices (npm)
- Jun 20, 2022
Malicious code in kusto-language-service (npm)
- Jun 20, 2022
Malicious code in gd-pc-common (npm)
- Jun 20, 2022
Malware in lorawan-devices
1 compromised version
- Jun 20, 2022
Malware in media-server-embed
1 compromised version
- Jun 20, 2022
Malware in kusto-language-service
1 compromised version
- Jun 20, 2022
Malware in gd-pc-common
1 compromised version
- Jun 20, 2022
Malicious code in plugin-proposal-export-default-from (npm)
- Jun 20, 2022
Malware in plugin-proposal-export-default-from
1 compromised version
- Jun 20, 2022
Malicious code in rush-lib (npm)
- Jun 20, 2022
Malicious code in plugin-syntax-flow (npm)
- Jun 20, 2022
Malicious code in nodehound (npm)
- Jun 20, 2022
Malicious code in exchange_clients (npm)
- Jun 20, 2022
Malware in exchange_clients
1 compromised version
- Jun 20, 2022
Malware in plugin-syntax-flow
1 compromised version
- Jun 20, 2022
Malware in rush-lib
1 compromised version
- Jun 20, 2022
Malware in nodehound
1 compromised version
- Jun 20, 2022
Malicious code in sdxcode (npm)
- Jun 20, 2022
Malicious code in random-vouchercode-generator (npm)
- Jun 20, 2022
Malicious code in fix-crash (npm)
- Jun 20, 2022
Malicious code in azure-arm-workspaces-samples-ts (npm)
- Jun 20, 2022
Malicious code in azure-arm-workspaces-samples-js (npm)
- Jun 20, 2022
Malware in sdxcode
1 compromised version
- Jun 20, 2022
Malware in azure-arm-workspaces-samples-js
1 compromised version
- Jun 20, 2022
Malware in azure-arm-workspaces-samples-ts
1 compromised version
- Jun 20, 2022
Malware in fix-crash
1 compromised version
- Jun 20, 2022
Malware in random-vouchercode-generator
1 compromised version
- Jun 20, 2022
Malicious code in azure-arm-migrate-samples-js (npm)
- Jun 20, 2022
Malicious code in azure-arm-marketplaceordering-samples-ts (npm)
- Jun 20, 2022
Malicious code in azure-arm-mariadb-samples-js (npm)
- Jun 20, 2022
Malware in azure-arm-marketplaceordering-samples-ts
1 compromised version
- Jun 20, 2022
Malware in azure-arm-migrate-samples-js
1 compromised version
- Jun 20, 2022
Malware in azure-arm-mariadb-samples-js
1 compromised version
- Jun 20, 2022
Malicious code in azure-arm-oep-samples-js-beta (npm)
- Jun 20, 2022
Malicious code in azure-arm-mixedreality-samples-js (npm)
- Jun 20, 2022
Malicious code in azure-arm-marketplaceordering-samples-js (npm)
- Jun 20, 2022
Malicious code in azure-arm-managementpartner-samples-js (npm)
- Jun 20, 2022
Malware in azure-arm-marketplaceordering-samples-js
1 compromised version
Page 4916 of 4,963