Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,939 total in npm · sorted newest first- Jun 20, 2022
Malicious code in eslint-config-pagseguro (npm)
- Jun 20, 2022
Malware in eslint-config-pagseguro
1 compromised version
- Jun 20, 2022
Malware in ps-validations
1 compromised version
- Jun 20, 2022
Malware in stylelint-bem-validator
1 compromised version
- Jun 20, 2022
Malware in ps-crypt
1 compromised version
- Jun 20, 2022
Malicious code in ps-cart-recovery (npm)
- Jun 20, 2022
Malicious code in pagseguro-utils (npm)
- Jun 20, 2022
Malicious code in pagseguro-user-session (npm)
- Jun 20, 2022
Malicious code in cgfnc2vndxjvn (npm)
- Jun 20, 2022
Malware in pagseguro-utils
1 compromised version
- Jun 20, 2022
Malware in cgfnc2vndxjvn
1 compromised version
- Jun 20, 2022
Malware in pagseguro-user-session
1 compromised version
- Jun 20, 2022
Malware in ps-cart-recovery
1 compromised version
- Jun 20, 2022
Malicious code in jt.timepicker (npm)
- Jun 20, 2022
Malicious code in grunt-jsdoc-to-markdow (npm)
- Jun 20, 2022
Malicious code in greensock-js (npm)
- Jun 20, 2022
Malicious code in codebird-js (npm)
- Jun 20, 2022
Malware in greensock-js
1 compromised version
- Jun 20, 2022
Malware in grunt-jsdoc-to-markdow
1 compromised version
- Jun 20, 2022
Malware in codebird-js
1 compromised version
- Jun 20, 2022
Malware in jt.timepicker
1 compromised version
- Jun 20, 2022
Malicious code in string_decoder-browserify (npm)
- Jun 20, 2022
Malicious code in react-instantsearch-hooks-dom (npm)
- Jun 20, 2022
Malicious code in parcel-plugin-test (npm)
- Jun 20, 2022
Malicious code in other-item (npm)
- Jun 20, 2022
Malware in react-instantsearch-hooks-dom
1 compromised version
- Jun 20, 2022
Malware in other-item
1 compromised version
- Jun 20, 2022
Malware in string_decoder-browserify
1 compromised version
- Jun 20, 2022
Malware in parcel-plugin-test
1 compromised version
- Jun 20, 2022
Malicious code in yello133 (npm)
- Jun 20, 2022
Malicious code in pod-smartphone-api (npm)
- Jun 20, 2022
Malicious code in hacker1337 (npm)
- Jun 20, 2022
Malicious code in fbtoken (npm)
- Jun 20, 2022
Malware in yello133
1 compromised version
- Jun 20, 2022
Malware in fbtoken
1 compromised version
- Jun 20, 2022
Malware in hacker1337
1 compromised version
- Jun 20, 2022
Malware in pod-smartphone-api
1 compromised version
- Jun 20, 2022
Malicious code in pod-api-client (npm)
- Jun 20, 2022
Malicious code in kakaga (npm)
- Jun 20, 2022
Malicious code in dependency1337 (npm)
- Jun 20, 2022
Malicious code in dependency123 (npm)
- Jun 20, 2022
Malware in dependency123
1 compromised version
- Jun 20, 2022
Malware in dependency1337
1 compromised version
- Jun 20, 2022
Malware in pod-api-client
1 compromised version
- Jun 20, 2022
Malware in kakaga
1 compromised version
- Jun 20, 2022
Malicious code in wixdev2022-1 (npm)
- Jun 20, 2022
Malicious code in nocuzune (npm)
- Jun 20, 2022
Malicious code in grabbir (npm)
- Jun 20, 2022
Malicious code in colors2.0 (npm)
- Jun 20, 2022
Malware in nocuzune
1 compromised version
Page 5025 of 5,079