Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
254,182 total in npm · sorted newest first- Jun 20, 2022
Malicious code in @feis-component/dialog-manager (npm)
- Jun 20, 2022
Malicious code in domestic-market-bundle (npm)
- Jun 20, 2022
Malicious code in deneuve-test-2 (npm)
- Jun 20, 2022
Malware in @feis-component/dialog-manager
1 compromised version
- Jun 20, 2022
Malware in domestic-market-bundle
1 compromised version
- Jun 20, 2022
Malware in deneuve-test-2
1 compromised version
- Jun 20, 2022
Malicious code in @kindred-feature/deposit-limits (npm)
- Jun 20, 2022
Malicious code in @kindred-brand/unibet (npm)
- Jun 20, 2022
Malicious code in generator-juicebox (npm)
- Jun 20, 2022
Malicious code in @feis-vanilla/vanilla-util (npm)
- Jun 20, 2022
Malicious code in @feis-vanilla/cms-intl (npm)
- Jun 20, 2022
Malware in @kindred-feature/deposit-limits
1 compromised version
- Jun 20, 2022
Malware in generator-juicebox
1 compromised version
- Jun 20, 2022
Malware in @feis-vanilla/cms-intl
1 compromised version
- Jun 20, 2022
Malware in @feis-vanilla/vanilla-util
1 compromised version
- Jun 20, 2022
Malware in @kindred-brand/unibet
1 compromised version
- Jun 20, 2022
Malicious code in p224 (npm)
- Jun 20, 2022
Malicious code in feature-gating (npm)
- Jun 20, 2022
Malicious code in byted-tma-pack (npm)
- Jun 20, 2022
Malware in byted-tma-pack
1 compromised version
- Jun 20, 2022
Malware in feature-gating
1 compromised version
- Jun 20, 2022
Malware in p224
1 compromised version
- Jun 20, 2022
Malicious code in yelp_page_complete (npm)
- Jun 20, 2022
Malicious code in event-bus-xp (npm)
- Jun 20, 2022
Malicious code in common-biz (npm)
- Jun 20, 2022
Malicious code in byted-lark-js-component (npm)
- Jun 20, 2022
Malicious code in app-config-v2 (npm)
- Jun 20, 2022
Malware in app-config-v2
1 compromised version
- Jun 20, 2022
Malware in yelp_page_complete
1 compromised version
- Jun 20, 2022
Malware in common-biz
1 compromised version
- Jun 20, 2022
Malware in byted-lark-js-component
1 compromised version
- Jun 20, 2022
Malware in event-bus-xp
1 compromised version
- Jun 20, 2022
Malicious code in ab-smartable (npm)
- Jun 20, 2022
Malicious code in ratelimittest (npm)
- Jun 20, 2022
Malicious code in feat-xsm-st-conflict-using-sheet-api (npm)
- Jun 20, 2022
Malicious code in boxworker (npm)
- Jun 20, 2022
Malware in feat-xsm-st-conflict-using-sheet-api
1 compromised version
- Jun 20, 2022
Malware in ab-smartable
1 compromised version
- Jun 20, 2022
Malware in boxworker
1 compromised version
- Jun 20, 2022
Malware in ratelimittest
1 compromised version
- Jun 20, 2022
Malicious code in newhistory (npm)
- Jun 20, 2022
Malicious code in featuretutorialmodal (npm)
- Jun 20, 2022
Malicious code in docvieweditorsicon (npm)
- Jun 20, 2022
Malware in featuretutorialmodal
1 compromised version
- Jun 20, 2022
Malware in newhistory
1 compromised version
- Jun 20, 2022
Malware in docvieweditorsicon
1 compromised version
- Jun 20, 2022
Malicious code in sheetdevtools (npm)
- Jun 20, 2022
Malware in sheetdevtools
1 compromised version
- Jun 20, 2022
Malicious code in @getstep/sdk (npm)
- Jun 20, 2022
Malicious code in preloadsmartablejs (npm)
Page 5010 of 5,084