Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
253,860 total in npm · sorted newest first- Jun 1, 2022
Malicious code in pocjenkircetest (npm)
- Jun 1, 2022
Malware in pocjenkircetest
1 compromised version
- Jun 1, 2022
Malicious code in hach-package-manager-bounty-hunter (npm)
- Jun 1, 2022
Malware in hach-package-manager-bounty-hunter
1 compromised version
- Jun 1, 2022
Malicious code in colors-support (npm)
- Jun 1, 2022
Malware in colors-support
1 compromised version
- Jun 1, 2022
Malicious code in titles (npm)
- Jun 1, 2022
Malicious code in sync-colors (npm)
- Jun 1, 2022
Malicious code in support-colors (npm)
- Jun 1, 2022
Malware in support-colors
1 compromised version
- Jun 1, 2022
Malware in sync-colors
1 compromised version
- Jun 1, 2022
Malware in titles
1 compromised version
- May 31, 2022
Malicious code in gatsby-plugin-conecad (npm)
- May 31, 2022
Malware in gatsby-plugin-conecad
1 compromised version
- May 31, 2022
Malicious code in @iwcp/nebula-ui (npm)
- May 31, 2022
Malware in @iwcp/nebula-ui
1 compromised version
- May 31, 2022
Malicious code in react-dom-router-compatibility (npm)
- May 31, 2022
Malware in react-dom-router-compatibility
1 compromised version
- May 31, 2022
Malicious code in react-dom-router-old (npm)
- May 31, 2022
Malware in react-dom-router-old
1 compromised version
- May 31, 2022
Malicious code in rkpacktest (npm)
- May 31, 2022
Malicious code in rkdvil (npm)
- May 31, 2022
Malware in rkpacktest
1 compromised version
- May 31, 2022
Malware in rkdvil
1 compromised version
- May 31, 2022
Malicious code in npm_ransomware (npm)
- May 31, 2022
Malware in npm_ransomware
1 compromised version
- May 31, 2022
Malicious code in stripe-connect-rocketrides (npm)
- May 31, 2022
Malicious code in sixt (npm)
- May 31, 2022
Malicious code in orangeonion.buildtools (npm)
- May 31, 2022
Malicious code in mb-blog (npm)
- May 31, 2022
Malicious code in lyft-avidl (npm)
- May 31, 2022
Malicious code in holvipartners (npm)
- May 31, 2022
Malicious code in flake8-holvi (npm)
- May 31, 2022
Malware in stripe-connect-rocketrides
1 compromised version
- May 31, 2022
Malware in mb-blog
1 compromised version
- May 31, 2022
Malware in sixt
1 compromised version
- May 31, 2022
Malware in holvipartners
1 compromised version
- May 31, 2022
Malware in flake8-holvi
1 compromised version
- May 31, 2022
Malware in lyft-avidl
1 compromised version
- May 31, 2022
Malware in orangeonion.buildtools
1 compromised version
- May 31, 2022
Malicious code in colourize (npm)
- May 31, 2022
Malware in colourize
1 compromised version
- May 31, 2022
Malicious code in ai-indeed (npm)
- May 31, 2022
Malicious code in csdn-tree (npm)
- May 31, 2022
Malware in ai-indeed
1 compromised version
- May 31, 2022
Malware in csdn-tree
1 compromised version
- May 31, 2022
Malicious code in resadmin-web (npm)
- May 31, 2022
Malware in resadmin-web
1 compromised version
- May 31, 2022
Malicious code in ado-vue (npm)
- May 31, 2022
Malicious code in woocommerce-infinitepay (npm)
Page 5070 of 5,078