Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,038 total in npm · sorted newest first- Jun 20, 2022
Malicious code in client-recommendation (npm)
- Jun 20, 2022
Malicious code in azure-app-configuration-samples-ts (npm)
- Jun 20, 2022
Malware in client-recommendation
1 compromised version
- Jun 20, 2022
Malware in plugin-bugfix-v8-spread-parameters-in-optional-chaining
1 compromised version
- Jun 20, 2022
Malware in ringcentral-common-redirect
1 compromised version
- Jun 20, 2022
Malware in azure-app-configuration-samples-ts
1 compromised version
- Jun 20, 2022
Malicious code in zmarta-calculator (npm)
- Jun 20, 2022
Malicious code in language-service (npm)
- Jun 20, 2022
Malicious code in helper-module-context (npm)
- Jun 20, 2022
Malicious code in assessment-zmarta (npm)
- Jun 20, 2022
Malware in language-service
1 compromised version
- Jun 20, 2022
Malware in helper-module-context
1 compromised version
- Jun 20, 2022
Malware in assessment-zmarta
1 compromised version
- Jun 20, 2022
Malware in zmarta-calculator
1 compromised version
- Jun 20, 2022
Malicious code in production-x-company-internal1 (npm)
- Jun 20, 2022
Malicious code in plugin-svgo (npm)
- Jun 20, 2022
Malicious code in oci-console-navigation-registry (npm)
- Jun 20, 2022
Malicious code in kerocinefuel (npm)
- Jun 20, 2022
Malware in plugin-svgo
1 compromised version
- Jun 20, 2022
Malware in kerocinefuel
1 compromised version
- Jun 20, 2022
Malware in production-x-company-internal1
1 compromised version
- Jun 20, 2022
Malware in oci-console-navigation-registry
1 compromised version
- Jun 20, 2022
Malicious code in serotonine320 (npm)
- Jun 20, 2022
Malicious code in @rnps-ppr/ppr-gensenjs (npm)
- Jun 20, 2022
Malicious code in @rnps-ppr/gensen-gotham (npm)
- Jun 20, 2022
Malicious code in perulema (npm)
- Jun 20, 2022
Malware in serotonine320
1 compromised version
- Jun 20, 2022
Malware in @rnps-ppr/ppr-gensenjs
1 compromised version
- Jun 20, 2022
Malware in @rnps-ppr/gensen-gotham
1 compromised version
- Jun 20, 2022
Malware in perulema
1 compromised version
- Jun 20, 2022
Malicious code in @jumpstart-ui/utils (npm)
- Jun 20, 2022
Malicious code in color2.0.0 (npm)
- Jun 20, 2022
Malicious code in @contrast-security-inc/design-system-foundations (npm)
- Jun 20, 2022
Malicious code in angieslist-styles (npm)
- Jun 20, 2022
Malware in @jumpstart-ui/utils
1 compromised version
- Jun 20, 2022
Malware in color2.0.0
1 compromised version
- Jun 20, 2022
Malware in angieslist-styles
1 compromised version
- Jun 20, 2022
Malware in @contrast-security-inc/design-system-foundations
1 compromised version
- Jun 20, 2022
Malicious code in adiostcheusia (npm)
- Jun 20, 2022
Malicious code in ctct-helpers (npm)
- Jun 20, 2022
Malicious code in colors-2.0.0 (npm)
- Jun 20, 2022
Malicious code in bender-event-definition-loader (npm)
- Jun 20, 2022
Malicious code in apinitro (npm)
- Jun 20, 2022
Malware in ctct-helpers
1 compromised version
- Jun 20, 2022
Malware in bender-event-definition-loader
1 compromised version
- Jun 20, 2022
Malware in apinitro
1 compromised version
- Jun 20, 2022
Malware in adiostcheusia
1 compromised version
- Jun 20, 2022
Malware in colors-2.0.0
1 compromised version
- Jun 20, 2022
Malicious code in mailduli (npm)
- Jun 20, 2022
Malicious code in gd-ldc (npm)
Page 4921 of 4,961