Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,884 total in npm · sorted newest first- Jun 20, 2022
Malicious code in identity-browser-manual-tests (npm)
- Jun 20, 2022
Malicious code in azure-web-pubsub-samples-ts (npm)
- Jun 20, 2022
Malicious code in azure-package-name-test (npm)
- Jun 20, 2022
Malicious code in azure-keyvault-admin-samples-ts (npm)
- Jun 20, 2022
Malicious code in azure-communication-chat-samples-ts (npm)
- Jun 20, 2022
Malicious code in azure-communication-chat-samples-js (npm)
- Jun 20, 2022
Malware in azure-keyvault-admin-samples-ts
1 compromised version
- Jun 20, 2022
Malware in azure-web-pubsub-samples-ts
1 compromised version
- Jun 20, 2022
Malware in azure-package-name-test
1 compromised version
- Jun 20, 2022
Malware in azure-communication-chat-samples-js
1 compromised version
- Jun 20, 2022
Malware in identity-browser-manual-tests
1 compromised version
- Jun 20, 2022
Malware in azure-communication-chat-samples-ts
1 compromised version
- Jun 20, 2022
Malicious code in iotc-file-upload-device (npm)
- Jun 20, 2022
Malicious code in iot-central-high-availability-clients (npm)
- Jun 20, 2022
Malicious code in azure-cosmos-samples-ts (npm)
- Jun 20, 2022
Malware in iotc-file-upload-device
1 compromised version
- Jun 20, 2022
Malware in azure-cosmos-samples-ts
1 compromised version
- Jun 20, 2022
Malware in iot-central-high-availability-clients
1 compromised version
- Jun 20, 2022
Malicious code in typescript-react-sample (npm)
- Jun 20, 2022
Malware in typescript-react-sample
1 compromised version
- Jun 20, 2022
Malicious code in samples-web-workers-ts (npm)
- Jun 20, 2022
Malicious code in electron-test-app (npm)
- Jun 20, 2022
Malicious code in durable-functions-samples (npm)
- Jun 20, 2022
Malware in samples-web-workers-ts
1 compromised version
- Jun 20, 2022
Malware in durable-functions-samples
1 compromised version
- Jun 20, 2022
Malware in electron-test-app
1 compromised version
- Jun 20, 2022
Malicious code in samples-cors-typescript (npm)
- Jun 20, 2022
Malicious code in lx-web-service-utils (npm)
- Jun 20, 2022
Malicious code in @lxo-blocks/react (npm)
- Jun 20, 2022
Malicious code in azure-api-style-guide (npm)
- Jun 20, 2022
Malware in lx-web-service-utils
1 compromised version
- Jun 20, 2022
Malware in @lxo-blocks/react
1 compromised version
- Jun 20, 2022
Malware in azure-api-style-guide
1 compromised version
- Jun 20, 2022
Malware in samples-cors-typescript
1 compromised version
- Jun 20, 2022
Malicious code in pattern-middleware (npm)
- Jun 20, 2022
Malicious code in lx-cockpit-components-loader (npm)
- Jun 20, 2022
Malicious code in ing-message-screen (npm)
- Jun 20, 2022
Malicious code in ing-feat-view-cancel-payments (npm)
- Jun 20, 2022
Malware in ing-message-screen
1 compromised version
- Jun 20, 2022
Malware in ing-feat-view-cancel-payments
1 compromised version
- Jun 20, 2022
Malware in lx-cockpit-components-loader
1 compromised version
- Jun 20, 2022
Malware in pattern-middleware
1 compromised version
- Jun 20, 2022
Malicious code in all-digital (npm)
- Jun 20, 2022
Malicious code in gd-react-toolbox (npm)
- Jun 20, 2022
Malicious code in gd-gplus (npm)
- Jun 20, 2022
Malicious code in azure-filter-3 (npm)
- Jun 20, 2022
Malware in gd-react-toolbox
1 compromised version
- Jun 20, 2022
Malware in azure-filter-3
1 compromised version
- Jun 20, 2022
Malware in gd-gplus
1 compromised version
- Jun 20, 2022
Malware in all-digital
1 compromised version
Page 5030 of 5,078