Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,878 total in npm · sorted newest first- Jun 20, 2022
Malicious code in hydrogen-monorepo (npm)
- Jun 20, 2022
Malicious code in helix-rum-collector (npm)
- Jun 20, 2022
Malicious code in heft-component-rig (npm)
- Jun 20, 2022
Malicious code in generator-connection (npm)
- Jun 20, 2022
Malicious code in files_pdfviewer (npm)
- Jun 20, 2022
Malicious code in eyeglass-embroider-app (npm)
- Jun 20, 2022
Malicious code in example-typescript (npm)
- Jun 20, 2022
Malicious code in example-rust (npm)
- Jun 20, 2022
Malicious code in example-google-analytics (npm)
- Jun 20, 2022
Malicious code in example-api-routes (npm)
- Jun 20, 2022
Malicious code in ethers-js-snap (npm)
- Jun 20, 2022
Malicious code in eth-faucet (npm)
- Jun 20, 2022
Malicious code in discount-functions-sample-app (npm)
- Jun 20, 2022
Malicious code in contributor-site (npm)
- Jun 20, 2022
Malicious code in contract-metadata (npm)
- Jun 20, 2022
Malicious code in contentsource-connector (npm)
- Jun 20, 2022
Malicious code in com.natw.secret_store_example (npm)
- Jun 20, 2022
Malicious code in bakaman (npm)
- Jun 20, 2022
Malicious code in babel-preset-es201 (npm)
- Jun 20, 2022
Malicious code in attention-editor (npm)
- Jun 20, 2022
Malware in remote-ui
1 compromised version
- Jun 20, 2022
Malware in twofactor_totp
1 compromised version
- Jun 20, 2022
Malware in nft-tickets-workshop
1 compromised version
- Jun 20, 2022
Malware in helix-rum-collector
1 compromised version
- Jun 20, 2022
Malware in react-native-performance-monorepo
1 compromised version
- Jun 20, 2022
Malware in generator-connection
1 compromised version
- Jun 20, 2022
Malware in babel-preset-es201
1 compromised version
- Jun 20, 2022
Malware in action-publish-gh-pages
1 compromised version
- Jun 20, 2022
Malware in attention-editor
1 compromised version
- Jun 20, 2022
Malware in discount-functions-sample-app
1 compromised version
- Jun 20, 2022
Malware in sample-mini
1 compromised version
- Jun 20, 2022
Malware in example-google-analytics
1 compromised version
- Jun 20, 2022
Malware in slint-config-nodejs
1 compromised version
- Jun 20, 2022
Malware in shopify-cli-extensions-test-utils
1 compromised version
- Jun 20, 2022
Malware in metamask-docs
1 compromised version
- Jun 20, 2022
Malware in metamask
1 compromised version
- Jun 20, 2022
Malware in ui-extensions-dev-console-app
1 compromised version
- Jun 20, 2022
Malware in shopify-marketplaces-buyer-app
1 compromised version
- Jun 20, 2022
Malware in eyeglass-embroider-app
1 compromised version
- Jun 20, 2022
Malware in ruby-style-guide
1 compromised version
- Jun 20, 2022
Malware in com.natw.secret_store_example
1 compromised version
- Jun 20, 2022
Malware in example-typescript
1 compromised version
- Jun 20, 2022
Malware in spaces-design
1 compromised version
- Jun 20, 2022
Malware in contributor-site
1 compromised version
- Jun 20, 2022
Malware in contentsource-connector
1 compromised version
- Jun 20, 2022
Malware in mapray-js-monorepo
1 compromised version
- Jun 20, 2022
Malware in ethers-js-snap
1 compromised version
- Jun 20, 2022
Malware in iframe-execution-environment
1 compromised version
- Jun 20, 2022
Malware in metamask-state-log-explorer
1 compromised version
- Jun 20, 2022
Malware in hydrogen-monorepo
1 compromised version
Page 5057 of 5,078