Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,861 total in npm · sorted newest first- Jun 2, 2022
Malware in apnic-bootstrap4
1 compromised version
- Jun 1, 2022
Malicious code in @superbet-group/testsandbox (npm)
- Jun 1, 2022
Malware in @superbet-group/testsandbox
1 compromised version
- Jun 1, 2022
Malicious code in sg-orbit (npm)
- Jun 1, 2022
Malicious code in sg-dome (npm)
- Jun 1, 2022
Malicious code in grunt-import-html (npm)
- Jun 1, 2022
Malicious code in azure-pipelines-dependency-track (npm)
- Jun 1, 2022
Malware in grunt-import-html
1 compromised version
- Jun 1, 2022
Malware in sg-dome
1 compromised version
- Jun 1, 2022
Malware in azure-pipelines-dependency-track
1 compromised version
- Jun 1, 2022
Malware in sg-orbit
1 compromised version
- Jun 1, 2022
Malicious code in @adam_baldwin/pingback (npm)
- Jun 1, 2022
Malware in @adam_baldwin/pingback
1 compromised version
- Jun 1, 2022
Malicious code in omniprotocol (npm)
- Jun 1, 2022
Malicious code in gctor-storage (npm)
- Jun 1, 2022
Malicious code in gc-gsl-editor (npm)
- Jun 1, 2022
Malware in gc-gsl-editor
1 compromised version
- Jun 1, 2022
Malware in omniprotocol
1 compromised version
- Jun 1, 2022
Malware in gctor-storage
1 compromised version
- Jun 1, 2022
Malicious code in bounty-plz (npm)
- Jun 1, 2022
Malware in bounty-plz
1 compromised version
- Jun 1, 2022
Malicious code in @adam_baldwin/tag-tmp (npm)
- Jun 1, 2022
Malware in @adam_baldwin/tag-tmp
1 compromised version
- Jun 1, 2022
Malicious code in inv-cyber-core (npm)
- Jun 1, 2022
Malicious code in inv-cyber (npm)
- Jun 1, 2022
Malware in inv-cyber
1 compromised version
- Jun 1, 2022
Malware in inv-cyber-core
1 compromised version
- Jun 1, 2022
Malicious code in @adam_baldwin/sample_4 (npm)
- Jun 1, 2022
Malware in @adam_baldwin/sample_4
1 compromised version
- Jun 1, 2022
Malicious code in dependencyconfusioncve2 (npm)
- Jun 1, 2022
Malicious code in dependencyconfusioncve (npm)
- Jun 1, 2022
Malware in dependencyconfusioncve2
1 compromised version
- Jun 1, 2022
Malware in dependencyconfusioncve
1 compromised version
- Jun 1, 2022
Malicious code in @image-process-library/blob-to-base64 (npm)
- Jun 1, 2022
Malware in @image-process-library/blob-to-base64
1 compromised version
- Jun 1, 2022
Malicious code in @tilliwilli/npm-lifecycles (npm)
- Jun 1, 2022
Malware in @tilliwilli/npm-lifecycles
1 compromised version
- Jun 1, 2022
Malicious code in @visiology-public-utilities/language-utils (npm)
- Jun 1, 2022
Malware in @visiology-public-utilities/language-utils
1 compromised version
- Jun 1, 2022
Malicious code in react-transition-group-community-version (npm)
- Jun 1, 2022
Malware in react-transition-group-community-version
1 compromised version
- Jun 1, 2022
Malicious code in @s3p-js-deep-purple/utils (npm)
- Jun 1, 2022
Malware in @s3p-js-deep-purple/utils
1 compromised version
- Jun 1, 2022
Malicious code in @amcdc/backend-api-swagger (npm)
- Jun 1, 2022
Malware in @amcdc/backend-api-swagger
1 compromised version
- Jun 1, 2022
Malicious code in kntl-digital3 (npm)
- Jun 1, 2022
Malware in kntl-digital3
1 compromised version
- Jun 1, 2022
Malicious code in depedence-confusion (npm)
- Jun 1, 2022
Malware in depedence-confusion
1 compromised version
- Jun 1, 2022
Malicious code in @azure-test2/test2 (npm)
Page 5069 of 5,078