Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,878 total in npm · sorted newest first- Jun 13, 2022
Malicious code in vimeo-threejs-player (npm)
- Jun 13, 2022
Malware in vimeo_depth_player
1 compromised version
- Jun 13, 2022
Malware in aframe-vimeo-component
1 compromised version
- Jun 13, 2022
Malware in vimeo-threejs-player
1 compromised version
- Jun 13, 2022
Malicious code in acronis-ui-kit (npm)
- Jun 13, 2022
Malware in acronis-ui-kit
1 compromised version
- Jun 13, 2022
Malicious code in @strava/clio (npm)
- Jun 13, 2022
Malware in @strava/clio
1 compromised version
- Jun 13, 2022
Malicious code in orion-web (npm)
- Jun 13, 2022
Malware in orion-web
1 compromised version
- Jun 13, 2022
Malicious code in rc-trigger-popup (npm)
- Jun 13, 2022
Malware in rc-trigger-popup
1 compromised version
- Jun 13, 2022
Malicious code in gd-activity-tracker (npm)
- Jun 13, 2022
Malware in gd-activity-tracker
1 compromised version
- Jun 13, 2022
Malicious code in @transaction-history/ui-components (npm)
- Jun 13, 2022
Malware in @transaction-history/ui-components
1 compromised version
- Jun 13, 2022
Malicious code in ptmproc (npm)
- Jun 13, 2022
Malicious code in paytm-kafka-rest (npm)
- Jun 13, 2022
Malicious code in dashboard-modules (npm)
- Jun 13, 2022
Malware in dashboard-modules
1 compromised version
- Jun 13, 2022
Malware in ptmproc
1 compromised version
- Jun 13, 2022
Malware in paytm-kafka-rest
1 compromised version
- Jun 13, 2022
Malicious code in zomato-ui (npm)
- Jun 13, 2022
Malicious code in holvi-validation (npm)
- Jun 13, 2022
Malware in holvi-validation
1 compromised version
- Jun 13, 2022
Malware in zomato-ui
1 compromised version
- Jun 13, 2022
Malicious code in vso-workbench (npm)
- Jun 13, 2022
Malicious code in vso-splash-screen-terminals (npm)
- Jun 13, 2022
Malicious code in vso-service-worker-client (npm)
- Jun 13, 2022
Malicious code in vso-service-worker (npm)
- Jun 13, 2022
Malware in vso-service-worker
1 compromised version
- Jun 13, 2022
Malware in vso-splash-screen-terminals
1 compromised version
- Jun 13, 2022
Malware in vso-service-worker-client
1 compromised version
- Jun 13, 2022
Malware in vso-workbench
1 compromised version
- Jun 13, 2022
Malicious code in vso-ts-agent (npm)
- Jun 13, 2022
Malicious code in cs-connection-hub (npm)
- Jun 13, 2022
Malware in cs-connection-hub
1 compromised version
- Jun 13, 2022
Malware in vso-ts-agent
1 compromised version
- Jun 13, 2022
Malicious code in package-sidr (npm)
- Jun 13, 2022
Malicious code in kbrstore (npm)
- Jun 13, 2022
Malicious code in iconion-package (npm)
- Jun 13, 2022
Malware in kbrstore
1 compromised version
- Jun 13, 2022
Malware in iconion-package
1 compromised version
- Jun 13, 2022
Malware in package-sidr
1 compromised version
- Jun 13, 2022
Malicious code in subek (npm)
- Jun 13, 2022
Malicious code in packages-icons (npm)
- Jun 13, 2022
Malicious code in package-show (npm)
- Jun 13, 2022
Malicious code in package-icon (npm)
- Jun 13, 2022
Malicious code in icons-package (npm)
- Jun 13, 2022
Malicious code in dist-sidr (npm)
Page 5064 of 5,078