Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 15, 2025
Malware in @vapc-ui/font-icon
1 compromised version
- Jul 15, 2025
Malware in @vapc-ui/search-box
1 compromised version
- Jul 15, 2025
Malware in @cpce/console-sub-app
1 compromised version
- Jul 15, 2025
Malicious code in @pmm-ux/asset-uploader (npm)
- Jul 15, 2025
Malware in @pmm-ux/asset-uploader
1 compromised version
- Jul 15, 2025
Malicious code in @indigo-web/material (npm)
39 compromised versions
- Jul 15, 2025
Malicious code in @indigo-mobile/material (npm)
24 compromised versions
- Jul 15, 2025
Malware in @indigo-mobile/material
1 compromised version
- Jul 15, 2025
Malware in @indigo-web/material
1 compromised version
- Jul 15, 2025
Malicious code in @indigo-multi/fonts (npm)
14 compromised versions
- Jul 15, 2025
Malware in @indigo-multi/fonts
1 compromised version
- Jul 15, 2025
Malicious code in vitejs-plugin-refresh (npm)
- Jul 15, 2025
Malicious code in jsonlis-conf (npm)
- Jul 15, 2025
Malware in jsonlis-conf
1 compromised version
- Jul 15, 2025
Malware in vitejs-plugin-refresh
1 compromised version
- Jul 15, 2025
Malware in test4-ross4
1 compromised version
- Jul 15, 2025
Malware in protos-gen-node
1 compromised version
- Jul 15, 2025
Malicious code in notifier-loggers (npm)
- Jul 15, 2025
Malicious code in js-prettier (npm)
- Jul 15, 2025
Malware in notifier-loggers
1 compromised version
- Jul 15, 2025
Malware in js-prettier
1 compromised version
- Jul 15, 2025
Malware in @emersonecologics/emerson-angular-trove
1 compromised version
- Jul 15, 2025
Malware in emerson-angular-trove
1 compromised version
- Jul 15, 2025
Malicious code in ui-router-cool-plugin (npm)
- Jul 15, 2025
Malicious code in themeone-utils (npm)
3 compromised versions
- Jul 15, 2025
Malicious code in laudekasarkarmulavakghantamuzi (npm)
1 compromised version
- Jul 15, 2025
Malicious code in heronumberone (npm)
- Jul 15, 2025
Malware in laudekasarkarmulavakghantamuzi
1 compromised version
- Jul 15, 2025
Malware in ember-routing-htmlbars
1 compromised version
- Jul 15, 2025
Malware in themeone-animate
1 compromised version
- Jul 15, 2025
Malware in ui-router-cool-plugin
1 compromised version
- Jul 15, 2025
Malware in themeone-utils
1 compromised version
- Jul 15, 2025
Malware in themeone-event
1 compromised version
- Jul 15, 2025
Malware in heronumberone
1 compromised version
- Jul 15, 2025
Malware in ebay.cookies
1 compromised version
- Jul 15, 2025
Malware in cvent-event-calendar
1 compromised version
- Jul 15, 2025
Malicious code in shardeum-json-rpc (npm)
- Jul 15, 2025
Malicious code in finactivitiy-run (npm)
- Jul 15, 2025
Malicious code in crypto-com-developer-platform-client (npm)
3 compromised versions
- Jul 15, 2025
Malware in crypto-com-developer-platform-client
1 compromised version
- Jul 15, 2025
Malware in finactivitiy-run
1 compromised version
- Jul 15, 2025
Malware in shardeum-json-rpc
1 compromised version
- Jul 15, 2025
Malware in cooo
1 compromised version
- Jul 15, 2025
Malware in com.razer.chromasdk
1 compromised version
- Jul 15, 2025
Malicious code in jss-0.8.4 (npm)
- Jul 15, 2025
Malicious code in js-0.8.3 (npm)
- Jul 15, 2025
Malicious code in codecops (npm)
- Jul 15, 2025
Malware in jss-0.8.4
1 compromised version
- Jul 15, 2025
Malware in codecops
1 compromised version
- Jul 15, 2025
Malware in js-0.8.3
1 compromised version
Page 5814 of 6,634