Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,879 total in npm · sorted newest first- Jun 20, 2022
Malware in @partner-global-ui/components
1 compromised version
- Jun 20, 2022
Malicious code in gd-user-login (npm)
- Jun 20, 2022
Malicious code in gd-storage (npm)
- Jun 20, 2022
Malicious code in gd-sprite (npm)
- Jun 20, 2022
Malicious code in gd-i18n (npm)
- Jun 20, 2022
Malware in gd-storage
1 compromised version
- Jun 20, 2022
Malware in gd-user-login
1 compromised version
- Jun 20, 2022
Malware in gd-i18n
1 compromised version
- Jun 20, 2022
Malware in gd-sprite
1 compromised version
- Jun 20, 2022
Malicious code in gd-ui-kit (npm)
- Jun 20, 2022
Malicious code in gd-sass (npm)
- Jun 20, 2022
Malicious code in gd-lazyload (npm)
- Jun 20, 2022
Malicious code in gd-display-ads (npm)
- Jun 20, 2022
Malware in gd-display-ads
1 compromised version
- Jun 20, 2022
Malware in gd-sass
1 compromised version
- Jun 20, 2022
Malware in gd-lazyload
1 compromised version
- Jun 20, 2022
Malware in gd-ui-kit
1 compromised version
- Jun 20, 2022
Malicious code in www.podium.com (npm)
- Jun 20, 2022
Malicious code in raygun.status (npm)
- Jun 20, 2022
Malicious code in gd-header (npm)
- Jun 20, 2022
Malicious code in gd-analytics (npm)
- Jun 20, 2022
Malware in gd-analytics
1 compromised version
- Jun 20, 2022
Malware in www.podium.com
1 compromised version
- Jun 20, 2022
Malware in raygun.status
1 compromised version
- Jun 20, 2022
Malware in gd-header
1 compromised version
- Jun 20, 2022
Malicious code in sa-383-bulk-creative-update (npm)
- Jun 20, 2022
Malicious code in @bijie/react-bnb (npm)
- Jun 20, 2022
Malware in sa-383-bulk-creative-update
1 compromised version
- Jun 20, 2022
Malware in @bijie/react-bnb
1 compromised version
- Jun 20, 2022
Malicious code in @bijie/react-bnb-biz (npm)
- Jun 20, 2022
Malware in @bijie/react-bnb-biz
1 compromised version
- Jun 20, 2022
Malicious code in test-marek-common (npm)
- Jun 20, 2022
Malicious code in test-custom-repo (npm)
- Jun 20, 2022
Malicious code in @hex-/xd (npm)
- Jun 20, 2022
Malicious code in bsd-global-nav-design-ui (npm)
- Jun 20, 2022
Malware in test-marek-common
1 compromised version
- Jun 20, 2022
Malware in test-custom-repo
1 compromised version
- Jun 20, 2022
Malware in @hex-/xd
1 compromised version
- Jun 20, 2022
Malware in bsd-global-nav-design-ui
1 compromised version
- Jun 20, 2022
Malicious code in ringcentral-common-redirect (npm)
- Jun 20, 2022
Malicious code in plugin-bugfix-v8-spread-parameters-in-optional-chaining (npm)
- Jun 20, 2022
Malicious code in client-recommendation (npm)
- Jun 20, 2022
Malicious code in azure-app-configuration-samples-ts (npm)
- Jun 20, 2022
Malware in client-recommendation
1 compromised version
- Jun 20, 2022
Malware in plugin-bugfix-v8-spread-parameters-in-optional-chaining
1 compromised version
- Jun 20, 2022
Malware in ringcentral-common-redirect
1 compromised version
- Jun 20, 2022
Malware in azure-app-configuration-samples-ts
1 compromised version
- Jun 20, 2022
Malicious code in zmarta-calculator (npm)
- Jun 20, 2022
Malicious code in language-service (npm)
- Jun 20, 2022
Malicious code in helper-module-context (npm)
Page 5037 of 5,078