Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,900 total in npm · sorted newest first- Jun 20, 2022
Malware in mixed-reality-remote-rendering
1 compromised version
- Jun 20, 2022
Malware in mixed-reality-authentication
1 compromised version
- Jun 20, 2022
Malware in opentelemetry-instrumentation-azure-sdk
1 compromised version
- Jun 20, 2022
Malware in monitor-opentelemetry-exporter
1 compromised version
- Jun 20, 2022
Malicious code in storage-blob-changefeed (npm)
- Jun 20, 2022
Malicious code in quantum-jobs (npm)
- Jun 20, 2022
Malicious code in purview-scanning (npm)
- Jun 20, 2022
Malicious code in purview-catalog (npm)
- Jun 20, 2022
Malicious code in purview-administration (npm)
- Jun 20, 2022
Malware in storage-blob-changefeed
1 compromised version
- Jun 20, 2022
Malware in quantum-jobs
1 compromised version
- Jun 20, 2022
Malware in purview-scanning
1 compromised version
- Jun 20, 2022
Malware in purview-catalog
1 compromised version
- Jun 20, 2022
Malware in purview-administration
1 compromised version
- Jun 20, 2022
Malicious code in synapse-monitoring (npm)
- Jun 20, 2022
Malicious code in synapse-managed-private-endpoints (npm)
- Jun 20, 2022
Malicious code in synapse-artifacts (npm)
- Jun 20, 2022
Malicious code in synapse-access-control (npm)
- Jun 20, 2022
Malicious code in storage-queue (npm)
- Jun 20, 2022
Malware in synapse-access-control
1 compromised version
- Jun 20, 2022
Malware in synapse-monitoring
1 compromised version
- Jun 20, 2022
Malware in storage-queue
1 compromised version
- Jun 20, 2022
Malware in synapse-managed-private-endpoints
1 compromised version
- Jun 20, 2022
Malware in synapse-artifacts
1 compromised version
- Jun 20, 2022
Malicious code in videojs-wistia (npm)
- Jun 20, 2022
Malicious code in video-analyzer-edge (npm)
- Jun 20, 2022
Malicious code in synapse-spark (npm)
- Jun 20, 2022
Malware in videojs-wistia
1 compromised version
- Jun 20, 2022
Malware in synapse-spark
1 compromised version
- Jun 20, 2022
Malware in video-analyzer-edge
1 compromised version
- Jun 20, 2022
Malicious code in web-pubsub-express (npm)
- Jun 20, 2022
Malicious code in web-pubsub (npm)
- Jun 20, 2022
Malicious code in mailjet-react-components (npm)
- Jun 20, 2022
Malicious code in mailjet-old-react-components (npm)
- Jun 20, 2022
Malware in mailjet-old-react-components
1 compromised version
- Jun 20, 2022
Malware in web-pubsub
1 compromised version
- Jun 20, 2022
Malware in mailjet-react-components
1 compromised version
- Jun 20, 2022
Malware in web-pubsub-express
1 compromised version
- Jun 20, 2022
Malicious code in node-cron-master1 (npm)
- Jun 20, 2022
Malicious code in node-cron-master (npm)
- Jun 20, 2022
Malicious code in epic-ue-themes-la (npm)
- Jun 20, 2022
Malicious code in discord-sniper (npm)
- Jun 20, 2022
Malicious code in cron-guru (npm)
- Jun 20, 2022
Malware in discord-sniper
1 compromised version
- Jun 20, 2022
Malware in node-cron-master1
1 compromised version
- Jun 20, 2022
Malware in cron-guru
1 compromised version
- Jun 20, 2022
Malware in epic-ue-themes-la
1 compromised version
- Jun 20, 2022
Malware in node-cron-master
1 compromised version
- Jun 20, 2022
Malicious code in test-credential (npm)
- Jun 20, 2022
Malicious code in synapse-access-control-1 (npm)
Page 5028 of 5,078