Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
254,479 total in npm · sorted newest first- Jun 20, 2022
Malware in dontinstallmeiamatest11
1 compromised version
- Jun 20, 2022
Malware in azure-function-test
1 compromised version
- Jun 20, 2022
Malware in dependency-testing
1 compromised version
- Jun 20, 2022
Malware in monorepo-symlink-test
1 compromised version
- Jun 20, 2022
Malicious code in service-bus-v1 (npm)
- Jun 20, 2022
Malicious code in karma-coverage-coffee (npm)
- Jun 20, 2022
Malicious code in azurevmtest (npm)
- Jun 20, 2022
Malicious code in azurearctest (npm)
- Jun 20, 2022
Malware in azurearctest
1 compromised version
- Jun 20, 2022
Malware in service-bus-v1
1 compromised version
- Jun 20, 2022
Malware in azurevmtest
1 compromised version
- Jun 20, 2022
Malware in karma-coverage-coffee
1 compromised version
- Jun 20, 2022
Malicious code in service-bus-v9 (npm)
- Jun 20, 2022
Malicious code in service-bus-v7 (npm)
- Jun 20, 2022
Malicious code in samples-cors-typescript-server (npm)
- Jun 20, 2022
Malicious code in samples-cors-typescript-client (npm)
- Jun 20, 2022
Malware in samples-cors-typescript-server
1 compromised version
- Jun 20, 2022
Malware in service-bus-v7
1 compromised version
- Jun 20, 2022
Malware in service-bus-v9
1 compromised version
- Jun 20, 2022
Malware in samples-cors-typescript-client
1 compromised version
- Jun 20, 2022
Malicious code in rush-common (npm)
- Jun 20, 2022
Malicious code in pnpm-local-install (npm)
- Jun 20, 2022
Malicious code in extraneous-dev-dep (npm)
- Jun 20, 2022
Malicious code in ci-rush (npm)
- Jun 20, 2022
Malware in rush-common
1 compromised version
- Jun 20, 2022
Malware in ci-rush
1 compromised version
- Jun 20, 2022
Malware in pnpm-local-install
1 compromised version
- Jun 20, 2022
Malware in extraneous-dev-dep
1 compromised version
- Jun 20, 2022
Malicious code in ts-genapi (npm)
- Jun 20, 2022
Malicious code in npm-cli-docs (npm)
- Jun 20, 2022
Malicious code in md-mock-api (npm)
- Jun 20, 2022
Malicious code in extraneous-detected (npm)
- Jun 20, 2022
Malware in npm-cli-docs
1 compromised version
- Jun 20, 2022
Malware in ts-genapi
1 compromised version
- Jun 20, 2022
Malware in extraneous-detected
1 compromised version
- Jun 20, 2022
Malware in md-mock-api
1 compromised version
- Jun 20, 2022
Malicious code in keyvault-mock-attestation (npm)
- Jun 20, 2022
Malicious code in azure-communication-sms (npm)
- Jun 20, 2022
Malicious code in azure-communication-short-codes (npm)
- Jun 20, 2022
Malicious code in azure-communication-identity (npm)
- Jun 20, 2022
Malware in azure-communication-identity
1 compromised version
- Jun 20, 2022
Malware in keyvault-mock-attestation
1 compromised version
- Jun 20, 2022
Malware in azure-communication-sms
1 compromised version
- Jun 20, 2022
Malware in azure-communication-short-codes
1 compromised version
- Jun 20, 2022
Malicious code in keyvault-keys (npm)
- Jun 20, 2022
Malicious code in azure-communication-phone-numbers (npm)
- Jun 20, 2022
Malicious code in azure-communication-network-traversal (npm)
- Jun 20, 2022
Malicious code in azure-communication-chat (npm)
- Jun 20, 2022
Malware in azure-communication-chat
1 compromised version
- Jun 20, 2022
Malware in azure-communication-phone-numbers
1 compromised version
Page 4990 of 5,090