Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,878 total in npm · sorted newest first- Jun 20, 2022
Malware in monday-ui-react-core-vibe
1 compromised version
- Jun 20, 2022
Malware in odesk.bpa-tsf-calc-bundle
1 compromised version
- Jun 20, 2022
Malware in ot-react-jed
1 compromised version
- Jun 20, 2022
Malware in roblox-es6-migration-helper
1 compromised version
- Jun 20, 2022
Malicious code in xenolith (npm)
- Jun 20, 2022
Malicious code in redocoem-bamm (npm)
- Jun 20, 2022
Malicious code in meoconlonton-vhx-fresh (npm)
- Jun 20, 2022
Malicious code in meoconlonton-vhx (npm)
- Jun 20, 2022
Malware in meoconlonton-vhx-fresh
1 compromised version
- Jun 20, 2022
Malware in meoconlonton-vhx
1 compromised version
- Jun 20, 2022
Malware in redocoem-bamm
1 compromised version
- Jun 20, 2022
Malware in xenolith
1 compromised version
- Jun 20, 2022
Malicious code in testing-npm-random (npm)
- Jun 20, 2022
Malicious code in random-testing-npm (npm)
- Jun 20, 2022
Malicious code in new-random-test (npm)
- Jun 20, 2022
Malicious code in meoconlonton-vhx-cricle (npm)
- Jun 20, 2022
Malware in testing-npm-random
1 compromised version
- Jun 20, 2022
Malware in new-random-test
1 compromised version
- Jun 20, 2022
Malware in meoconlonton-vhx-cricle
1 compromised version
- Jun 20, 2022
Malware in random-testing-npm
1 compromised version
- Jun 20, 2022
Malicious code in test2_11931193 (npm)
- Jun 20, 2022
Malicious code in small_11931193 (npm)
- Jun 20, 2022
Malicious code in npm-1193119390 (npm)
- Jun 20, 2022
Malicious code in big_11931193 (npm)
- Jun 20, 2022
Malware in npm-1193119390
1 compromised version
- Jun 20, 2022
Malware in small_11931193
1 compromised version
- Jun 20, 2022
Malware in big_11931193
1 compromised version
- Jun 20, 2022
Malware in test2_11931193
1 compromised version
- Jun 20, 2022
Malicious code in multiple-inheritance-rest (npm)
- Jun 20, 2022
Malicious code in eslint-config-support (npm)
- Jun 20, 2022
Malicious code in body-string-rest (npm)
- Jun 20, 2022
Malicious code in body-string (npm)
- Jun 20, 2022
Malware in eslint-config-support
1 compromised version
- Jun 20, 2022
Malware in body-string-rest
1 compromised version
- Jun 20, 2022
Malware in multiple-inheritance-rest
1 compromised version
- Jun 20, 2022
Malware in body-string
1 compromised version
- Jun 20, 2022
Malicious code in custom-url-moreoptions (npm)
- Jun 20, 2022
Malicious code in custom-url (npm)
- Jun 20, 2022
Malicious code in constantparam (npm)
- Jun 20, 2022
Malicious code in body-time (npm)
- Jun 20, 2022
Malware in constantparam
1 compromised version
- Jun 20, 2022
Malware in custom-url-moreoptions
1 compromised version
- Jun 20, 2022
Malware in custom-url
1 compromised version
- Jun 20, 2022
Malware in body-time
1 compromised version
- Jun 20, 2022
Malicious code in iotspaces (npm)
- Jun 20, 2022
Malicious code in httpinfrastructure (npm)
- Jun 20, 2022
Malicious code in custom-url-paging (npm)
- Jun 20, 2022
Malicious code in code-snippet-frontend (npm)
- Jun 20, 2022
Malicious code in body-complex (npm)
- Jun 20, 2022
Malware in body-complex
1 compromised version
Page 5039 of 5,078