Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
248,005 total in npm · sorted newest first- May 23, 2022
Malicious code in @kibt/operation-track (npm)
- May 23, 2022
Malware in @kibt/weblogger
1 compromised version
- May 23, 2022
Malware in @kibt/operation-track
1 compromised version
- May 19, 2022
Malicious code in mollie-design-system (npm)
- May 19, 2022
Malicious code in dgse-tools-mgm-elf-helper (npm)
- May 19, 2022
Malicious code in ddc-new-relic (npm)
- May 19, 2022
Malicious code in ddc-classnames-js (npm)
- May 19, 2022
Malicious code in axp-utility-belt (npm)
- May 19, 2022
Malicious code in axp-shared-scripts (npm)
- May 19, 2022
Malicious code in axp-base (npm)
- May 19, 2022
Malware in axp-utility-belt
1 compromised version
- May 19, 2022
Malware in ddc-new-relic
1 compromised version
- May 19, 2022
Malware in axp-shared-scripts
1 compromised version
- May 19, 2022
Malware in dgse-tools-mgm-elf-helper
1 compromised version
- May 19, 2022
Malware in mollie-design-system
1 compromised version
- May 19, 2022
Malware in ddc-classnames-js
1 compromised version
- May 19, 2022
Malware in axp-base
1 compromised version
- May 19, 2022
Malicious code in website-404-error-page (npm)
- May 19, 2022
Malware in website-404-error-page
1 compromised version
- May 18, 2022
Malicious code in starter-theme (npm)
- May 18, 2022
Malicious code in pp-react-buttons (npm)
- May 18, 2022
Malicious code in pp-mp-connected-path (npm)
- May 18, 2022
Malicious code in paypal-rest-sample (npm)
- May 18, 2022
Malicious code in epic-support-prettier-config (npm)
- May 18, 2022
Malicious code in epic-games-self-service-portal (npm)
- May 18, 2022
Malware in epic-support-prettier-config
1 compromised version
- May 18, 2022
Malware in paypal-rest-sample
1 compromised version
- May 18, 2022
Malware in pp-react-buttons
1 compromised version
- May 18, 2022
Malware in epic-games-self-service-portal
1 compromised version
- May 18, 2022
Malware in pp-mp-connected-path
1 compromised version
- May 18, 2022
Malware in starter-theme
1 compromised version
- May 18, 2022
Malicious code in dom-diff-exporter (npm)
- May 18, 2022
Malicious code in diff-dom-2 (npm)
- May 18, 2022
Malware in dom-diff-exporter
1 compromised version
- May 18, 2022
Malware in diff-dom-2
1 compromised version
- May 18, 2022
Malicious code in videojs-vtt (npm)
- May 18, 2022
Malicious code in @commercialsalesandmarketing/contact-search (npm)
- May 18, 2022
Malware in videojs-vtt
1 compromised version
- May 18, 2022
Malware in @commercialsalesandmarketing/contact-search
1 compromised version
- May 18, 2022
Malicious code in pg-ng-popover (npm)
- May 18, 2022
Malware in pg-ng-popover
1 compromised version
- May 18, 2022
Malicious code in pco_api (npm)
- May 18, 2022
Malware in pco_api
1 compromised version
- May 17, 2022
Malicious code in angieslist-composed-components (npm)
- May 17, 2022
Malicious code in girolv (npm)
- May 17, 2022
Malware in angieslist-composed-components
1 compromised version
- May 17, 2022
Malware in girolv
1 compromised version
- May 17, 2022
Malicious code in zureexplorer2 (npm)
- May 17, 2022
Malware in zureexplorer2
1 compromised version
- May 17, 2022
Malicious code in somewhereinbetween (npm)
Page 4957 of 4,961