Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,861 total in npm · sorted newest first- Jun 8, 2022
Malicious code in d2l-rubric-polymer (npm)
- Jun 8, 2022
Malicious code in d2l-rubric (npm)
- Jun 8, 2022
Malware in d2l-rubric-polymer
1 compromised version
- Jun 8, 2022
Malware in d2l-rubric
1 compromised version
- Jun 8, 2022
Malicious code in ddd-demo3 (npm)
- Jun 8, 2022
Malware in ddd-demo3
1 compromised version
- Jun 8, 2022
Malicious code in ddd-demo2 (npm)
- Jun 8, 2022
Malicious code in ddd-demo (npm)
- Jun 8, 2022
Malware in ddd-demo2
1 compromised version
- Jun 8, 2022
Malware in ddd-demo
1 compromised version
- Jun 3, 2022
Malicious code in nab-packages-react-utils-nab (npm)
- Jun 2, 2022
Malicious code in api-token-admin (npm)
- Jun 2, 2022
Malware in api-token-admin
1 compromised version
- Jun 2, 2022
Malicious code in stylis-ifl4 (npm)
- Jun 2, 2022
Malware in stylis-ifl4
1 compromised version
- Jun 2, 2022
Malicious code in color-xzibit (npm)
- Jun 2, 2022
Malware in color-xzibit
1 compromised version
- Jun 2, 2022
Malicious code in discordjs-selfbotjs (npm)
- Jun 2, 2022
Malware in discordjs-selfbotjs
1 compromised version
- Jun 2, 2022
Malicious code in epic-ue-fonts (npm)
- Jun 2, 2022
Malware in epic-ue-fonts
1 compromised version
- Jun 2, 2022
Malicious code in web-excess (npm)
- Jun 2, 2022
Malware in web-excess
1 compromised version
- Jun 2, 2022
Malicious code in @pixiv-vroid-hub/vroid-hub-viewer (npm)
- Jun 2, 2022
Malicious code in @design-components/customer (npm)
- Jun 2, 2022
Malicious code in @chegg-me-components/header (npm)
- Jun 2, 2022
Malware in @pixiv-vroid-hub/vroid-hub-viewer
1 compromised version
- Jun 2, 2022
Malware in @chegg-me-components/header
1 compromised version
- Jun 2, 2022
Malware in @design-components/customer
1 compromised version
- Jun 2, 2022
Malicious code in vfdp-ui-framework (npm)
- Jun 2, 2022
Malware in vfdp-ui-framework
1 compromised version
- Jun 2, 2022
Malicious code in npmbulabula (npm)
- Jun 2, 2022
Malware in npmbulabula
1 compromised version
- Jun 2, 2022
Malicious code in wormhole-icco (npm)
- Jun 2, 2022
Malicious code in makerdao-governance-bot (npm)
- Jun 2, 2022
Malware in wormhole-icco
1 compromised version
- Jun 2, 2022
Malware in makerdao-governance-bot
1 compromised version
- Jun 2, 2022
Malicious code in wormhole-client (npm)
- Jun 2, 2022
Malicious code in volcan0x (npm)
- Jun 2, 2022
Malicious code in olx-hubot (npm)
- Jun 2, 2022
Malicious code in insights-explorer (npm)
- Jun 2, 2022
Malicious code in dai-pg (npm)
- Jun 2, 2022
Malware in volcan0x
1 compromised version
- Jun 2, 2022
Malware in wormhole-client
1 compromised version
- Jun 2, 2022
Malware in insights-explorer
1 compromised version
- Jun 2, 2022
Malware in olx-hubot
1 compromised version
- Jun 2, 2022
Malware in dai-pg
1 compromised version
- Jun 2, 2022
Malicious code in lexical-monorepo (npm)
- Jun 2, 2022
Malware in lexical-monorepo
1 compromised version
- Jun 2, 2022
Malicious code in apnic-bootstrap4 (npm)
Page 5068 of 5,078