Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
254,182 total in npm · sorted newest first- Jun 20, 2022
Malware in envoy-curses
1 compromised version
- Jun 20, 2022
Malware in webpack.js.org
1 compromised version
- Jun 20, 2022
Malicious code in xss-test-gaurav (npm)
- Jun 20, 2022
Malicious code in com.microsoft.msbuildforunity (npm)
- Jun 20, 2022
Malicious code in cd-themes (npm)
- Jun 20, 2022
Malicious code in cd-interfaces (npm)
- Jun 20, 2022
Malware in cd-interfaces
1 compromised version
- Jun 20, 2022
Malware in com.microsoft.msbuildforunity
1 compromised version
- Jun 20, 2022
Malware in cd-themes
1 compromised version
- Jun 20, 2022
Malware in xss-test-gaurav
1 compromised version
- Jun 20, 2022
Malicious code in @frontend-metrics/gtm (npm)
- Jun 20, 2022
Malicious code in com.unity.xr.windowsmr.metro (npm)
- Jun 20, 2022
Malicious code in com.unity.xr.openxr (npm)
- Jun 20, 2022
Malicious code in com.microsoft.mixedreality.toolkit.tools (npm)
- Jun 20, 2022
Malware in com.microsoft.mixedreality.toolkit.tools
1 compromised version
- Jun 20, 2022
Malware in @frontend-metrics/gtm
1 compromised version
- Jun 20, 2022
Malware in com.unity.xr.openxr
1 compromised version
- Jun 20, 2022
Malware in com.unity.xr.windowsmr.metro
1 compromised version
- Jun 20, 2022
Malicious code in @frontend-metrics/hotjar (npm)
- Jun 20, 2022
Malicious code in discord-v11 (npm)
- Jun 20, 2022
Malicious code in console-less-variables (npm)
- Jun 20, 2022
Malicious code in blz-internal-pkg (npm)
- Jun 20, 2022
Malware in @frontend-metrics/hotjar
1 compromised version
- Jun 20, 2022
Malware in discord-v11
1 compromised version
- Jun 20, 2022
Malware in console-less-variables
1 compromised version
- Jun 20, 2022
Malware in blz-internal-pkg
1 compromised version
- Jun 20, 2022
Malicious code in satreg-bits (npm)
- Jun 20, 2022
Malicious code in personal-info (npm)
- Jun 20, 2022
Malicious code in kastjs (npm)
- Jun 20, 2022
Malicious code in buffer-fetch (npm)
- Jun 20, 2022
Malware in satreg-bits
1 compromised version
- Jun 20, 2022
Malware in personal-info
1 compromised version
- Jun 20, 2022
Malware in buffer-fetch
1 compromised version
- Jun 20, 2022
Malware in kastjs
1 compromised version
- Jun 20, 2022
Malicious code in wg5 (npm)
- Jun 20, 2022
Malicious code in site-vue (npm)
- Jun 20, 2022
Malicious code in multisig-tool (npm)
- Jun 20, 2022
Malicious code in mbed-drivers (npm)
- Jun 20, 2022
Malware in multisig-tool
1 compromised version
- Jun 20, 2022
Malware in site-vue
1 compromised version
- Jun 20, 2022
Malware in mbed-drivers
1 compromised version
- Jun 20, 2022
Malware in wg5
1 compromised version
- Jun 20, 2022
Malicious code in vgs-staging (npm)
- Jun 20, 2022
Malicious code in vgs-auth (npm)
- Jun 20, 2022
Malicious code in kakakaakaaa (npm)
- Jun 20, 2022
Malicious code in kakakaaka (npm)
- Jun 20, 2022
Malware in vgs-auth
1 compromised version
- Jun 20, 2022
Malware in kakakaakaaa
1 compromised version
- Jun 20, 2022
Malware in vgs-staging
1 compromised version
- Jun 20, 2022
Malware in kakakaaka
1 compromised version
Page 5008 of 5,084