Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,878 total in npm · sorted newest first- Jun 20, 2022
Malicious code in kapks (npm)
- Jun 20, 2022
Malicious code in git-en-boite-core (npm)
- Jun 20, 2022
Malicious code in git-en-boite-app (npm)
- Jun 20, 2022
Malware in kapks
1 compromised version
- Jun 20, 2022
Malware in selenium-applitools
1 compromised version
- Jun 20, 2022
Malware in git-en-boite-core
1 compromised version
- Jun 20, 2022
Malware in git-en-boite-app
1 compromised version
- Jun 20, 2022
Malware in tapks
1 compromised version
- Jun 20, 2022
Malicious code in tiktok_embed (npm)
- Jun 20, 2022
Malicious code in simplemde-angular (npm)
- Jun 20, 2022
Malicious code in babel-plugin-svg-em-dimensions (npm)
- Jun 20, 2022
Malware in babel-plugin-svg-em-dimensions
1 compromised version
- Jun 20, 2022
Malware in tiktok_embed
1 compromised version
- Jun 20, 2022
Malware in simplemde-angular
1 compromised version
- Jun 20, 2022
Malicious code in af-test (npm)
- Jun 20, 2022
Malicious code in af-mason (npm)
- Jun 20, 2022
Malicious code in clientlib-manifests (npm)
- Jun 20, 2022
Malware in af-test
1 compromised version
- Jun 20, 2022
Malware in af-mason
1 compromised version
- Jun 20, 2022
Malware in clientlib-manifests
1 compromised version
- Jun 20, 2022
Malicious code in ui-extensions-server-kit (npm)
- Jun 20, 2022
Malicious code in realtime-react (npm)
- Jun 20, 2022
Malicious code in react-monorail-next (npm)
- Jun 20, 2022
Malicious code in onboarding-setup-guide (npm)
- Jun 20, 2022
Malware in onboarding-setup-guide
1 compromised version
- Jun 20, 2022
Malware in realtime-react
1 compromised version
- Jun 20, 2022
Malware in react-monorail-next
1 compromised version
- Jun 20, 2022
Malware in ui-extensions-server-kit
1 compromised version
- Jun 20, 2022
Malicious code in spiferack (npm)
- Jun 20, 2022
Malicious code in realtime-react-ui (npm)
- Jun 20, 2022
Malicious code in polaris-next (npm)
- Jun 20, 2022
Malicious code in apollo-workarounds (npm)
- Jun 20, 2022
Malware in polaris-next
1 compromised version
- Jun 20, 2022
Malware in realtime-react-ui
1 compromised version
- Jun 20, 2022
Malware in apollo-workarounds
1 compromised version
- Jun 20, 2022
Malware in spiferack
1 compromised version
- Jun 20, 2022
Malicious code in supplysec-alert (npm)
- Jun 20, 2022
Malicious code in piwik-pro-angular-tracking (npm)
- Jun 20, 2022
Malicious code in data-api.js-core (npm)
- Jun 20, 2022
Malicious code in colors-1.0 (npm)
- Jun 20, 2022
Malware in supplysec-alert
1 compromised version
- Jun 20, 2022
Malware in colors-1.0
1 compromised version
- Jun 20, 2022
Malware in piwik-pro-angular-tracking
1 compromised version
- Jun 20, 2022
Malware in data-api.js-core
1 compromised version
- Jun 20, 2022
Malicious code in snyk-resolve-dep (npm)
- Jun 20, 2022
Malicious code in snyk-azure-pipelines-task (npm)
- Jun 20, 2022
Malicious code in ffwebsite (npm)
- Jun 20, 2022
Malicious code in aoxqgmortgkgldq (npm)
- Jun 20, 2022
Malware in snyk-resolve-dep
1 compromised version
- Jun 20, 2022
Malware in snyk-azure-pipelines-task
1 compromised version
Page 5044 of 5,078