Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,019 total in npm · sorted newest first- Jun 20, 2022
Malware in meoconlonton-vhx
1 compromised version
- Jun 20, 2022
Malware in redocoem-bamm
1 compromised version
- Jun 20, 2022
Malware in xenolith
1 compromised version
- Jun 20, 2022
Malicious code in testing-npm-random (npm)
- Jun 20, 2022
Malicious code in random-testing-npm (npm)
- Jun 20, 2022
Malicious code in new-random-test (npm)
- Jun 20, 2022
Malicious code in meoconlonton-vhx-cricle (npm)
- Jun 20, 2022
Malware in testing-npm-random
1 compromised version
- Jun 20, 2022
Malware in new-random-test
1 compromised version
- Jun 20, 2022
Malware in meoconlonton-vhx-cricle
1 compromised version
- Jun 20, 2022
Malware in random-testing-npm
1 compromised version
- Jun 20, 2022
Malicious code in test2_11931193 (npm)
- Jun 20, 2022
Malicious code in small_11931193 (npm)
- Jun 20, 2022
Malicious code in npm-1193119390 (npm)
- Jun 20, 2022
Malicious code in big_11931193 (npm)
- Jun 20, 2022
Malware in npm-1193119390
1 compromised version
- Jun 20, 2022
Malware in small_11931193
1 compromised version
- Jun 20, 2022
Malware in big_11931193
1 compromised version
- Jun 20, 2022
Malware in test2_11931193
1 compromised version
- Jun 20, 2022
Malicious code in multiple-inheritance-rest (npm)
- Jun 20, 2022
Malicious code in eslint-config-support (npm)
- Jun 20, 2022
Malicious code in body-string-rest (npm)
- Jun 20, 2022
Malicious code in body-string (npm)
- Jun 20, 2022
Malware in eslint-config-support
1 compromised version
- Jun 20, 2022
Malware in body-string-rest
1 compromised version
- Jun 20, 2022
Malware in multiple-inheritance-rest
1 compromised version
- Jun 20, 2022
Malware in body-string
1 compromised version
- Jun 20, 2022
Malicious code in custom-url-moreoptions (npm)
- Jun 20, 2022
Malicious code in custom-url (npm)
- Jun 20, 2022
Malicious code in constantparam (npm)
- Jun 20, 2022
Malicious code in body-time (npm)
- Jun 20, 2022
Malware in constantparam
1 compromised version
- Jun 20, 2022
Malware in custom-url-moreoptions
1 compromised version
- Jun 20, 2022
Malware in custom-url
1 compromised version
- Jun 20, 2022
Malware in body-time
1 compromised version
- Jun 20, 2022
Malicious code in iotspaces (npm)
- Jun 20, 2022
Malicious code in httpinfrastructure (npm)
- Jun 20, 2022
Malicious code in custom-url-paging (npm)
- Jun 20, 2022
Malicious code in code-snippet-frontend (npm)
- Jun 20, 2022
Malicious code in body-complex (npm)
- Jun 20, 2022
Malware in body-complex
1 compromised version
- Jun 20, 2022
Malware in iotspaces
1 compromised version
- Jun 20, 2022
Malware in code-snippet-frontend
1 compromised version
- Jun 20, 2022
Malware in custom-url-paging
1 compromised version
- Jun 20, 2022
Malware in httpinfrastructure
1 compromised version
- Jun 20, 2022
Malicious code in orbit-tracking (npm)
- Jun 20, 2022
Malicious code in nodejs-gcloud-pubsub-module (npm)
- Jun 20, 2022
Malicious code in itsmerobottt (npm)
- Jun 20, 2022
Malicious code in custom-script-vanilla-js (npm)
- Jun 20, 2022
Malware in custom-script-vanilla-js
1 compromised version
Page 4922 of 4,961