Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,878 total in npm · sorted newest first- Jun 20, 2022
Malicious code in dapp-inter-ui (npm)
- Jun 20, 2022
Malicious code in dapp-inter-agservers (npm)
- Jun 20, 2022
Malicious code in dapp-inter (npm)
- Jun 20, 2022
Malicious code in ashion-ingest (npm)
- Jun 20, 2022
Malware in ashion-ingest
1 compromised version
- Jun 20, 2022
Malware in megaman0072
1 compromised version
- Jun 20, 2022
Malware in git-dependency-maker
1 compromised version
- Jun 20, 2022
Malware in helix-status-service
1 compromised version
- Jun 20, 2022
Malware in dapp-inter
1 compromised version
- Jun 20, 2022
Malware in dapp-inter-ui
1 compromised version
- Jun 20, 2022
Malware in upgrade-challenge
1 compromised version
- Jun 20, 2022
Malware in agoric-servers
1 compromised version
- Jun 20, 2022
Malware in helix-run-query
1 compromised version
- Jun 20, 2022
Malware in npm-mega
1 compromised version
- Jun 20, 2022
Malware in dapp-inter-agservers
1 compromised version
- Jun 20, 2022
Malware in helix-slack-notification
1 compromised version
- Jun 20, 2022
Malware in megamanz07007
1 compromised version
- Jun 20, 2022
Malware in helix-contentsource-connector
1 compromised version
- Jun 20, 2022
Malicious code in action-publish-gh-pages (npm)
- Jun 20, 2022
Malicious code in action-create-release-pr (npm)
- Jun 20, 2022
Malicious code in webpack-vue-config (npm)
- Jun 20, 2022
Malicious code in ui-extensions-dev-console-app (npm)
- Jun 20, 2022
Malicious code in typescript-snap (npm)
- Jun 20, 2022
Malicious code in twofactor_totp (npm)
- Jun 20, 2022
Malicious code in template-snap-monorepo (npm)
- Jun 20, 2022
Malicious code in spaces-design (npm)
- Jun 20, 2022
Malicious code in snapcanvas-sdk (npm)
- Jun 20, 2022
Malicious code in slint-config-nodejs (npm)
- Jun 20, 2022
Malicious code in slack-notification (npm)
- Jun 20, 2022
Malicious code in shopify-marketplaces-buyer-app (npm)
- Jun 20, 2022
Malicious code in shopify-cli-extensions-test-utils (npm)
- Jun 20, 2022
Malicious code in sample-mini (npm)
- Jun 20, 2022
Malicious code in ruby-style-guide (npm)
- Jun 20, 2022
Malicious code in rnskia (npm)
- Jun 20, 2022
Malicious code in remote-ui (npm)
- Jun 20, 2022
Malicious code in react-native-performance-monorepo (npm)
- Jun 20, 2022
Malicious code in react-jesting-library (npm)
- Jun 20, 2022
Malicious code in polaris-for-vscode (npm)
- Jun 20, 2022
Malicious code in polaris-for-figma (npm)
- Jun 20, 2022
Malicious code in pcln-types (npm)
- Jun 20, 2022
Malicious code in nnabla-browser (npm)
- Jun 20, 2022
Malicious code in nft-tickets-workshop (npm)
- Jun 20, 2022
Malicious code in new-npm-packages (npm)
- Jun 20, 2022
Malicious code in minis-samples (npm)
- Jun 20, 2022
Malicious code in metamask-state-log-explorer (npm)
- Jun 20, 2022
Malicious code in metamask-docs (npm)
- Jun 20, 2022
Malicious code in metamask (npm)
- Jun 20, 2022
Malicious code in megaman-007mega (npm)
- Jun 20, 2022
Malicious code in mapray-js-monorepo (npm)
- Jun 20, 2022
Malicious code in iframe-execution-environment (npm)
Page 5056 of 5,078