Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,947 total in npm · sorted newest first- Jun 20, 2022
Malware in wechat-base
1 compromised version
- Jun 20, 2022
Malware in wechat-service
1 compromised version
- Jun 20, 2022
Malware in feishu-js-jdk
1 compromised version
- Jun 20, 2022
Malicious code in wechat-user (npm)
- Jun 20, 2022
Malicious code in meituan-js-jdk (npm)
- Jun 20, 2022
Malicious code in douyin-js-jdk (npm)
- Jun 20, 2022
Malicious code in bytedance-js-jdk (npm)
- Jun 20, 2022
Malware in meituan-js-jdk
1 compromised version
- Jun 20, 2022
Malware in douyin-js-jdk
1 compromised version
- Jun 20, 2022
Malware in wechat-user
1 compromised version
- Jun 20, 2022
Malware in bytedance-js-jdk
1 compromised version
- Jun 20, 2022
Malicious code in alipay-js-jdk (npm)
- Jun 20, 2022
Malicious code in wechat-web-login (npm)
- Jun 20, 2022
Malicious code in qq-web-login (npm)
- Jun 20, 2022
Malicious code in qq-qrcode-login (npm)
- Jun 20, 2022
Malicious code in huawei-js-sdk (npm)
- Jun 20, 2022
Malware in alipay-js-jdk
1 compromised version
- Jun 20, 2022
Malware in qq-qrcode-login
1 compromised version
- Jun 20, 2022
Malware in huawei-js-sdk
1 compromised version
- Jun 20, 2022
Malware in qq-web-login
1 compromised version
- Jun 20, 2022
Malware in wechat-web-login
1 compromised version
- Jun 20, 2022
Malicious code in aliyun-js-sdk (npm)
- Jun 20, 2022
Malicious code in alicloud-js-sdk (npm)
- Jun 20, 2022
Malicious code in wechat-rn (npm)
- Jun 20, 2022
Malicious code in wechat-mobile (npm)
- Jun 20, 2022
Malware in aliyun-js-sdk
1 compromised version
- Jun 20, 2022
Malware in wechat-rn
1 compromised version
- Jun 20, 2022
Malware in alicloud-js-sdk
1 compromised version
- Jun 20, 2022
Malware in wechat-mobile
1 compromised version
- Jun 20, 2022
Malicious code in tencent-js-sdk (npm)
- Jun 20, 2022
Malicious code in protobufjs-databricks (npm)
- Jun 20, 2022
Malicious code in pingan-js-sdk (npm)
- Jun 20, 2022
Malicious code in lenovo-js-sdk (npm)
- Jun 20, 2022
Malware in protobufjs-databricks
1 compromised version
- Jun 20, 2022
Malware in tencent-js-sdk
1 compromised version
- Jun 20, 2022
Malware in lenovo-js-sdk
1 compromised version
- Jun 20, 2022
Malware in pingan-js-sdk
1 compromised version
- Jun 20, 2022
Malicious code in spark-pr-board (npm)
- Jun 20, 2022
Malicious code in helloadmin (npm)
- Jun 20, 2022
Malicious code in dpgs (npm)
- Jun 20, 2022
Malicious code in coupa-common-js (npm)
- Jun 20, 2022
Malware in helloadmin
1 compromised version
- Jun 20, 2022
Malware in dpgs
1 compromised version
- Jun 20, 2022
Malware in coupa-common-js
1 compromised version
- Jun 20, 2022
Malware in spark-pr-board
1 compromised version
- Jun 20, 2022
Malicious code in skfb-viewer-protocol (npm)
- Jun 20, 2022
Malicious code in @sravni/oh-my-got (npm)
- Jun 20, 2022
Malicious code in @ozon-bx/ui-components (npm)
- Jun 20, 2022
Malicious code in maps-theme (npm)
- Jun 20, 2022
Malware in skfb-viewer-protocol
1 compromised version
Page 5017 of 5,079