Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,886 total in npm · sorted newest first- Jun 20, 2022
Malicious code in kakakaakaaa11aaa3_returns_hello_jfrog2a (npm)
- Jun 20, 2022
Malicious code in kakakaakaaa11aaa3_returns_hello_jfrog2 (npm)
- Jun 20, 2022
Malicious code in azure-template-cpp (npm)
- Jun 20, 2022
Malicious code in azure-container-registry-samples-ts (npm)
- Jun 20, 2022
Malicious code in azure-container-registry-samples-js (npm)
- Jun 20, 2022
Malware in kakakaakaaa11aaa3_returns_hello_jfrog2a
1 compromised version
- Jun 20, 2022
Malware in azure-template-cpp
1 compromised version
- Jun 20, 2022
Malware in kakakaakaaa11aaa3_returns_hello_jfrog2
1 compromised version
- Jun 20, 2022
Malware in azure-container-registry-samples-ts
1 compromised version
- Jun 20, 2022
Malware in azure-container-registry-samples-js
1 compromised version
- Jun 20, 2022
Malicious code in jobspecification (npm)
- Jun 20, 2022
Malicious code in iotc-migrator (npm)
- Jun 20, 2022
Malicious code in cloudjob (npm)
- Jun 20, 2022
Malicious code in azure-storage-common-cpp (npm)
- Jun 20, 2022
Malware in cloudjob
1 compromised version
- Jun 20, 2022
Malware in iotc-migrator
1 compromised version
- Jun 20, 2022
Malware in azure-storage-common-cpp
1 compromised version
- Jun 20, 2022
Malware in jobspecification
1 compromised version
- Jun 20, 2022
Malicious code in sql-action (npm)
- Jun 20, 2022
Malicious code in kubernetes-ingest (npm)
- Jun 20, 2022
Malicious code in blobindexfunc (npm)
- Jun 20, 2022
Malicious code in apimanagementclient (npm)
- Jun 20, 2022
Malware in kubernetes-ingest
1 compromised version
- Jun 20, 2022
Malware in blobindexfunc
1 compromised version
- Jun 20, 2022
Malware in sql-action
1 compromised version
- Jun 20, 2022
Malware in apimanagementclient
1 compromised version
- Jun 20, 2022
Malicious code in azure-storage-file-datalake-samples-ts (npm)
- Jun 20, 2022
Malicious code in azure-arm-labservices-samples-js-beta (npm)
- Jun 20, 2022
Malware in azure-storage-file-datalake-samples-ts
1 compromised version
- Jun 20, 2022
Malware in azure-arm-labservices-samples-js-beta
1 compromised version
- Jun 20, 2022
Malicious code in azure-arm-labservices-samples-ts-beta (npm)
- Jun 20, 2022
Malware in azure-arm-labservices-samples-ts-beta
1 compromised version
- Jun 20, 2022
Malicious code in azure-arm-machinelearningexperimentation-samples-js-beta (npm)
- Jun 20, 2022
Malware in azure-arm-machinelearningexperimentation-samples-js-beta
1 compromised version
- Jun 20, 2022
Malicious code in rush-cpy (npm)
- Jun 20, 2022
Malicious code in azure-core-tracing-samples-ts (npm)
- Jun 20, 2022
Malicious code in azure-core-tracing-samples-js (npm)
- Jun 20, 2022
Malicious code in azure-arm-servicemap-samples-js-beta (npm)
- Jun 20, 2022
Malicious code in azure-arm-machinelearningexperimentation-samples-ts-beta (npm)
- Jun 20, 2022
Malware in azure-core-tracing-samples-ts
1 compromised version
- Jun 20, 2022
Malware in rush-cpy
1 compromised version
- Jun 20, 2022
Malware in azure-core-tracing-samples-js
1 compromised version
- Jun 20, 2022
Malware in azure-arm-servicemap-samples-js-beta
1 compromised version
- Jun 20, 2022
Malware in azure-arm-machinelearningexperimentation-samples-ts-beta
1 compromised version
- Jun 20, 2022
Malicious code in msal-node (npm)
- Jun 20, 2022
Malicious code in azure-template-samples-ts-beta (npm)
- Jun 20, 2022
Malicious code in azure-synapse-access-control-samples-js (npm)
- Jun 20, 2022
Malicious code in azure-output-customization-samples-ts (npm)
- Jun 20, 2022
Malware in azure-synapse-access-control-samples-js
1 compromised version
- Jun 20, 2022
Malware in azure-output-customization-samples-ts
1 compromised version
Page 5029 of 5,078