Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,005 total in npm · sorted newest first- Jun 20, 2022
Malicious code in onboarding-setup-guide (npm)
- Jun 20, 2022
Malware in onboarding-setup-guide
1 compromised version
- Jun 20, 2022
Malware in realtime-react
1 compromised version
- Jun 20, 2022
Malware in react-monorail-next
1 compromised version
- Jun 20, 2022
Malware in ui-extensions-server-kit
1 compromised version
- Jun 20, 2022
Malicious code in spiferack (npm)
- Jun 20, 2022
Malicious code in realtime-react-ui (npm)
- Jun 20, 2022
Malicious code in polaris-next (npm)
- Jun 20, 2022
Malicious code in apollo-workarounds (npm)
- Jun 20, 2022
Malware in polaris-next
1 compromised version
- Jun 20, 2022
Malware in realtime-react-ui
1 compromised version
- Jun 20, 2022
Malware in apollo-workarounds
1 compromised version
- Jun 20, 2022
Malware in spiferack
1 compromised version
- Jun 20, 2022
Malicious code in supplysec-alert (npm)
- Jun 20, 2022
Malicious code in piwik-pro-angular-tracking (npm)
- Jun 20, 2022
Malicious code in data-api.js-core (npm)
- Jun 20, 2022
Malicious code in colors-1.0 (npm)
- Jun 20, 2022
Malware in supplysec-alert
1 compromised version
- Jun 20, 2022
Malware in colors-1.0
1 compromised version
- Jun 20, 2022
Malware in piwik-pro-angular-tracking
1 compromised version
- Jun 20, 2022
Malware in data-api.js-core
1 compromised version
- Jun 20, 2022
Malicious code in snyk-resolve-dep (npm)
- Jun 20, 2022
Malicious code in snyk-azure-pipelines-task (npm)
- Jun 20, 2022
Malicious code in ffwebsite (npm)
- Jun 20, 2022
Malicious code in aoxqgmortgkgldq (npm)
- Jun 20, 2022
Malware in snyk-resolve-dep
1 compromised version
- Jun 20, 2022
Malware in snyk-azure-pipelines-task
1 compromised version
- Jun 20, 2022
Malware in aoxqgmortgkgldq
1 compromised version
- Jun 20, 2022
Malware in ffwebsite
1 compromised version
- Jun 20, 2022
Malicious code in touchright (npm)
- Jun 20, 2022
Malicious code in intentionally-malicious1 (npm)
- Jun 20, 2022
Malicious code in intentionally-malicious (npm)
- Jun 20, 2022
Malicious code in drwffjbwkwxsvyo (npm)
- Jun 20, 2022
Malware in intentionally-malicious1
1 compromised version
- Jun 20, 2022
Malware in touchright
1 compromised version
- Jun 20, 2022
Malware in drwffjbwkwxsvyo
1 compromised version
- Jun 20, 2022
Malware in intentionally-malicious
1 compromised version
- Jun 20, 2022
Malicious code in @w3-commons/js-build-resources (npm)
- Jun 20, 2022
Malicious code in @ibm-pipeline/logging (npm)
- Jun 20, 2022
Malicious code in getting-started-rpi (npm)
- Jun 20, 2022
Malicious code in gcs-malware-scanner (npm)
- Jun 20, 2022
Malware in gcs-malware-scanner
1 compromised version
- Jun 20, 2022
Malware in @ibm-pipeline/logging
1 compromised version
- Jun 20, 2022
Malware in getting-started-rpi
1 compromised version
- Jun 20, 2022
Malware in @w3-commons/js-build-resources
1 compromised version
- Jun 20, 2022
Malicious code in sq-jsith-test-npm-project (npm)
- Jun 20, 2022
Malicious code in discord.js-selfv14 (npm)
- Jun 20, 2022
Malicious code in colors-sync (npm)
- Jun 20, 2022
Malicious code in colors-dev (npm)
- Jun 20, 2022
Malware in discord.js-selfv14
1 compromised version
Page 4927 of 4,961