Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
254,479 total in npm · sorted newest first- Jun 20, 2022
Malicious code in @greetznl/eslint-config-greetz (npm)
- Jun 20, 2022
Malware in parlai-mturk-task-compiler
1 compromised version
- Jun 20, 2022
Malware in mephisto-task-compiler
1 compromised version
- Jun 20, 2022
Malware in @greetznl/eslint-config-greetz
1 compromised version
- Jun 20, 2022
Malware in fxa-profile-server
1 compromised version
- Jun 20, 2022
Malware in parlai-mephisto-task-compiler
1 compromised version
- Jun 20, 2022
Malicious code in @greetznl/node_metrics (npm)
- Jun 20, 2022
Malicious code in @greetznl/breekz (npm)
- Jun 20, 2022
Malicious code in extension-coordinator (npm)
- Jun 20, 2022
Malicious code in dobbin (npm)
- Jun 20, 2022
Malware in dobbin
1 compromised version
- Jun 20, 2022
Malware in @greetznl/node_metrics
1 compromised version
- Jun 20, 2022
Malware in @greetznl/breekz
1 compromised version
- Jun 20, 2022
Malware in extension-coordinator
1 compromised version
- Jun 20, 2022
Malicious code in twitch-recurly.js (npm)
- Jun 20, 2022
Malicious code in smoca (npm)
- Jun 20, 2022
Malicious code in grunt-smartling-sdk-twitch (npm)
- Jun 20, 2022
Malicious code in cdk-plugin-isengard (npm)
- Jun 20, 2022
Malicious code in asset-fingerprinting-list (npm)
- Jun 20, 2022
Malware in smoca
1 compromised version
- Jun 20, 2022
Malware in cdk-plugin-isengard
1 compromised version
- Jun 20, 2022
Malware in asset-fingerprinting-list
1 compromised version
- Jun 20, 2022
Malware in twitch-recurly.js
1 compromised version
- Jun 20, 2022
Malware in grunt-smartling-sdk-twitch
1 compromised version
- Jun 20, 2022
Malicious code in ember-intl-i18n-twitch (npm)
- Jun 20, 2022
Malicious code in ember-graceful-retry (npm)
- Jun 20, 2022
Malicious code in custom-cldr-rules-twitch (npm)
- Jun 20, 2022
Malware in custom-cldr-rules-twitch
1 compromised version
- Jun 20, 2022
Malware in ember-intl-i18n-twitch
1 compromised version
- Jun 20, 2022
Malware in ember-graceful-retry
1 compromised version
- Jun 20, 2022
Malicious code in twitch-twilight (npm)
- Jun 20, 2022
Malicious code in scale-css-loader (npm)
- Jun 20, 2022
Malicious code in network-metrics-js (npm)
- Jun 20, 2022
Malicious code in eslint-plugin-ember-rules-twitch (npm)
- Jun 20, 2022
Malware in eslint-plugin-ember-rules-twitch
1 compromised version
- Jun 20, 2022
Malware in network-metrics-js
1 compromised version
- Jun 20, 2022
Malware in twitch-twilight
1 compromised version
- Jun 20, 2022
Malware in scale-css-loader
1 compromised version
- Jun 20, 2022
Malicious code in scale-css-loaderx (npm)
- Jun 20, 2022
Malicious code in rush-prettier (npm)
- Jun 20, 2022
Malicious code in generate-doc (npm)
- Jun 20, 2022
Malicious code in dontinstallmeiamatest (npm)
- Jun 20, 2022
Malware in dontinstallmeiamatest
1 compromised version
- Jun 20, 2022
Malware in scale-css-loaderx
1 compromised version
- Jun 20, 2022
Malware in generate-doc
1 compromised version
- Jun 20, 2022
Malware in rush-prettier
1 compromised version
- Jun 20, 2022
Malicious code in monorepo-symlink-test (npm)
- Jun 20, 2022
Malicious code in dontinstallmeiamatest11 (npm)
- Jun 20, 2022
Malicious code in dependency-testing (npm)
- Jun 20, 2022
Malicious code in azure-function-test (npm)
Page 4989 of 5,090