Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,941 total in npm · sorted newest first- Jun 20, 2022
Malicious code in jetpack-api (npm)
- Jun 20, 2022
Malicious code in galaxyy-lib (npm)
- Jun 20, 2022
Malware in jetpack-connection
1 compromised version
- Jun 20, 2022
Malware in galaxyy-lib
1 compromised version
- Jun 20, 2022
Malware in jetpack-components
1 compromised version
- Jun 20, 2022
Malware in jetpack-api
1 compromised version
- Jun 20, 2022
Malware in jetpack-config
1 compromised version
- Jun 20, 2022
Malicious code in pepinole (npm)
- Jun 20, 2022
Malicious code in pedrolinsisi (npm)
- Jun 20, 2022
Malicious code in pedrito (npm)
- Jun 20, 2022
Malicious code in gradient-stringnnnn (npm)
- Jun 20, 2022
Malware in pedrito
1 compromised version
- Jun 20, 2022
Malware in pedrolinsisi
1 compromised version
- Jun 20, 2022
Malware in gradient-stringnnnn
1 compromised version
- Jun 20, 2022
Malware in pepinole
1 compromised version
- Jun 20, 2022
Malicious code in rocky_testing_confusion (npm)
- Jun 20, 2022
Malicious code in gradient-stringss (npm)
- Jun 20, 2022
Malicious code in gradient-strings (npm)
- Jun 20, 2022
Malicious code in gradient-stringn (npm)
- Jun 20, 2022
Malware in gradient-stringn
1 compromised version
- Jun 20, 2022
Malware in gradient-strings
1 compromised version
- Jun 20, 2022
Malware in rocky_testing_confusion
1 compromised version
- Jun 20, 2022
Malware in gradient-stringss
1 compromised version
- Jun 20, 2022
Malicious code in uxp-documentation (npm)
- Jun 20, 2022
Malicious code in moralis-web3-providers-ws (npm)
- Jun 20, 2022
Malicious code in lambda-common (npm)
- Jun 20, 2022
Malicious code in dp-testing (npm)
- Jun 20, 2022
Malware in lambda-common
1 compromised version
- Jun 20, 2022
Malware in moralis-web3-providers-ws
1 compromised version
- Jun 20, 2022
Malware in dp-testing
1 compromised version
- Jun 20, 2022
Malware in uxp-documentation
1 compromised version
- Jun 20, 2022
Malicious code in testmatrix (npm)
- Jun 20, 2022
Malicious code in ps-brands-assets (npm)
- Jun 20, 2022
Malicious code in moralis-websocket (npm)
- Jun 20, 2022
Malicious code in ibanking-shell (npm)
- Jun 20, 2022
Malware in moralis-websocket
1 compromised version
- Jun 20, 2022
Malware in ps-brands-assets
1 compromised version
- Jun 20, 2022
Malware in testmatrix
1 compromised version
- Jun 20, 2022
Malware in ibanking-shell
1 compromised version
- Jun 20, 2022
Malicious code in stylelint-config-pagseguro (npm)
- Jun 20, 2022
Malicious code in ps-request-ws (npm)
- Jun 20, 2022
Malicious code in ps-react-bootstrap (npm)
- Jun 20, 2022
Malicious code in ps-bootstrap (npm)
- Jun 20, 2022
Malicious code in ps-asymmetric-crypts (npm)
- Jun 20, 2022
Malware in ps-bootstrap
1 compromised version
- Jun 20, 2022
Malware in stylelint-config-pagseguro
1 compromised version
- Jun 20, 2022
Malware in ps-request-ws
1 compromised version
- Jun 20, 2022
Malware in ps-react-bootstrap
1 compromised version
- Jun 20, 2022
Malware in ps-asymmetric-crypts
1 compromised version
- Jun 20, 2022
Malicious code in stylelint-bem-validator (npm)
Page 5024 of 5,079