Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,947 total in npm · sorted newest first- Jun 20, 2022
Malware in @ozon-bx/ui-components
1 compromised version
- Jun 20, 2022
Malware in maps-theme
1 compromised version
- Jun 20, 2022
Malware in @sravni/oh-my-got
1 compromised version
- Jun 20, 2022
Malicious code in yahoo-react-select-box (npm)
- Jun 20, 2022
Malicious code in oh-my-got (npm)
- Jun 20, 2022
Malicious code in kakakaakaaa11aaa3 (npm)
- Jun 20, 2022
Malicious code in cschandragirisample (npm)
- Jun 20, 2022
Malware in kakakaakaaa11aaa3
1 compromised version
- Jun 20, 2022
Malware in yahoo-react-select-box
1 compromised version
- Jun 20, 2022
Malware in oh-my-got
1 compromised version
- Jun 20, 2022
Malware in cschandragirisample
1 compromised version
- Jun 20, 2022
Malicious code in angieslist-styleguide (npm)
- Jun 20, 2022
Malicious code in saddlebag-events (npm)
- Jun 20, 2022
Malicious code in ringrtc (npm)
- Jun 20, 2022
Malicious code in pf-web-build (npm)
- Jun 20, 2022
Malicious code in pcln-config (npm)
- Jun 20, 2022
Malware in ringrtc
1 compromised version
- Jun 20, 2022
Malware in pcln-config
1 compromised version
- Jun 20, 2022
Malware in angieslist-styleguide
1 compromised version
- Jun 20, 2022
Malware in pf-web-build
1 compromised version
- Jun 20, 2022
Malware in saddlebag-events
1 compromised version
- Jun 20, 2022
Malicious code in fake_la (npm)
- Jun 20, 2022
Malicious code in chainlink-qtum (npm)
- Jun 20, 2022
Malicious code in api-microsoft (npm)
- Jun 20, 2022
Malware in api-microsoft
1 compromised version
- Jun 20, 2022
Malware in fake_la
1 compromised version
- Jun 20, 2022
Malware in chainlink-qtum
1 compromised version
- Jun 20, 2022
Malicious code in ask-archie-shared (npm)
- Jun 20, 2022
Malware in ask-archie-shared
1 compromised version
- Jun 20, 2022
Malicious code in wrapped-adapter (npm)
- Jun 20, 2022
Malicious code in wootrade-adapter (npm)
- Jun 20, 2022
Malicious code in wbtc-address-set-adapter (npm)
- Jun 20, 2022
Malicious code in view-function-adapter (npm)
- Jun 20, 2022
Malware in view-function-adapter
1 compromised version
- Jun 20, 2022
Malware in wrapped-adapter
1 compromised version
- Jun 20, 2022
Malware in wbtc-address-set-adapter
1 compromised version
- Jun 20, 2022
Malware in wootrade-adapter
1 compromised version
- Jun 20, 2022
Malicious code in uscpi-one-adapter (npm)
- Jun 20, 2022
Malicious code in upvest-adapter (npm)
- Jun 20, 2022
Malicious code in uniswap-v3-adapter (npm)
- Jun 20, 2022
Malicious code in uniswap-v2-adapter (npm)
- Jun 20, 2022
Malicious code in unibit-adapter (npm)
- Jun 20, 2022
Malware in upvest-adapter
1 compromised version
- Jun 20, 2022
Malware in uniswap-v2-adapter
1 compromised version
- Jun 20, 2022
Malware in uscpi-one-adapter
1 compromised version
- Jun 20, 2022
Malware in unibit-adapter
1 compromised version
- Jun 20, 2022
Malware in uniswap-v3-adapter
1 compromised version
- Jun 20, 2022
Malicious code in twelvedata-adapter (npm)
- Jun 20, 2022
Malicious code in trueusd-adapter (npm)
- Jun 20, 2022
Malicious code in tradingeconomics-adapter (npm)
Page 5018 of 5,079