Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,878 total in npm · sorted newest first- Jun 20, 2022
Malware in language-service
1 compromised version
- Jun 20, 2022
Malware in helper-module-context
1 compromised version
- Jun 20, 2022
Malware in assessment-zmarta
1 compromised version
- Jun 20, 2022
Malware in zmarta-calculator
1 compromised version
- Jun 20, 2022
Malicious code in production-x-company-internal1 (npm)
- Jun 20, 2022
Malicious code in plugin-svgo (npm)
- Jun 20, 2022
Malicious code in oci-console-navigation-registry (npm)
- Jun 20, 2022
Malicious code in kerocinefuel (npm)
- Jun 20, 2022
Malware in plugin-svgo
1 compromised version
- Jun 20, 2022
Malware in kerocinefuel
1 compromised version
- Jun 20, 2022
Malware in production-x-company-internal1
1 compromised version
- Jun 20, 2022
Malware in oci-console-navigation-registry
1 compromised version
- Jun 20, 2022
Malicious code in serotonine320 (npm)
- Jun 20, 2022
Malicious code in @rnps-ppr/ppr-gensenjs (npm)
- Jun 20, 2022
Malicious code in @rnps-ppr/gensen-gotham (npm)
- Jun 20, 2022
Malicious code in perulema (npm)
- Jun 20, 2022
Malware in serotonine320
1 compromised version
- Jun 20, 2022
Malware in @rnps-ppr/ppr-gensenjs
1 compromised version
- Jun 20, 2022
Malware in @rnps-ppr/gensen-gotham
1 compromised version
- Jun 20, 2022
Malware in perulema
1 compromised version
- Jun 20, 2022
Malicious code in @jumpstart-ui/utils (npm)
- Jun 20, 2022
Malicious code in color2.0.0 (npm)
- Jun 20, 2022
Malicious code in @contrast-security-inc/design-system-foundations (npm)
- Jun 20, 2022
Malicious code in angieslist-styles (npm)
- Jun 20, 2022
Malware in @jumpstart-ui/utils
1 compromised version
- Jun 20, 2022
Malware in color2.0.0
1 compromised version
- Jun 20, 2022
Malware in angieslist-styles
1 compromised version
- Jun 20, 2022
Malware in @contrast-security-inc/design-system-foundations
1 compromised version
- Jun 20, 2022
Malicious code in adiostcheusia (npm)
- Jun 20, 2022
Malicious code in ctct-helpers (npm)
- Jun 20, 2022
Malicious code in colors-2.0.0 (npm)
- Jun 20, 2022
Malicious code in bender-event-definition-loader (npm)
- Jun 20, 2022
Malicious code in apinitro (npm)
- Jun 20, 2022
Malware in ctct-helpers
1 compromised version
- Jun 20, 2022
Malware in bender-event-definition-loader
1 compromised version
- Jun 20, 2022
Malware in apinitro
1 compromised version
- Jun 20, 2022
Malware in adiostcheusia
1 compromised version
- Jun 20, 2022
Malware in colors-2.0.0
1 compromised version
- Jun 20, 2022
Malicious code in mailduli (npm)
- Jun 20, 2022
Malicious code in gd-ldc (npm)
- Jun 20, 2022
Malicious code in fe-fabric-react (npm)
- Jun 20, 2022
Malicious code in dropins-components (npm)
- Jun 20, 2022
Malware in gd-ldc
1 compromised version
- Jun 20, 2022
Malware in mailduli
1 compromised version
- Jun 20, 2022
Malware in fe-fabric-react
1 compromised version
- Jun 20, 2022
Malware in dropins-components
1 compromised version
- Jun 20, 2022
Malicious code in roblox-es6-migration-helper (npm)
- Jun 20, 2022
Malicious code in ot-react-jed (npm)
- Jun 20, 2022
Malicious code in odesk.bpa-tsf-calc-bundle (npm)
- Jun 20, 2022
Malicious code in monday-ui-react-core-vibe (npm)
Page 5038 of 5,078