Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 14, 2025
Malware in ltiditest
1 compromised version
- Jul 14, 2025
Malware in @subsplash/auth
1 compromised version
- Jul 14, 2025
Malware in @cbre-internal/mapping-component
1 compromised version
- Jul 14, 2025
Malware in @sfdc-ogs/v1-stable
1 compromised version
- Jul 14, 2025
Malware in @yinc/ui
1 compromised version
- Jul 14, 2025
Malware in @gmgn/app-icons
1 compromised version
- Jul 14, 2025
Malware in @stride-mfe/wmc
1 compromised version
- Jul 14, 2025
Malware in ltiditest2
1 compromised version
- Jul 14, 2025
Malware in @platform-clientextensions/rum-web
1 compromised version
- Jul 14, 2025
Malware in agoda.cronos.gql
1 compromised version
- Jul 14, 2025
Malware in agoda.cronos.activities.client-side
1 compromised version
- Jul 14, 2025
Malware in groq-link
1 compromised version
- Jul 14, 2025
Malware in corplogger
1 compromised version
- Jul 14, 2025
Malicious code in aspnet-asset-management (npm)
- Jul 14, 2025
Malware in aspnet-asset-management
1 compromised version
- Jul 14, 2025
Malware in securityresearchpocaplmalpkg
1 compromised version
- Jul 14, 2025
Malware in open-source-catalog
1 compromised version
- Jul 14, 2025
Malware in vsts-iiswebapp
1 compromised version
- Jul 14, 2025
Malware in pp-react-utils
1 compromised version
- Jul 14, 2025
Malicious code in ultraconvert (npm)
- Jul 14, 2025
Malware in ultraconvert
1 compromised version
- Jul 14, 2025
Malicious code in ringcentral-google-drive-notification-add-in (npm)
1 compromised version
- Jul 14, 2025
Malicious code in eslint-config-ivy (npm)
2 compromised versions
- Jul 14, 2025
Malicious code in yandex-metrica (npm)
1 compromised version
- Jul 14, 2025
Malicious code in workspace-loader (npm)
1 compromised version
- Jul 14, 2025
Malicious code in ngf-attachments-list (npm)
2 compromised versions
- Jul 14, 2025
Malicious code in mgz-testpkg (npm)
1 compromised version
- Jul 14, 2025
Malicious code in ngf-gov-hr-navbar (npm)
1 compromised version
- Jul 14, 2025
Malicious code in ngf-attachment-item-view (npm)
1 compromised version
- Jul 14, 2025
Malicious code in colortoolsv2 (npm)
3 compromised versions
- Jul 14, 2025
Malware in colortoolsv2
1 compromised version
- Jul 13, 2025
Malicious code in @isfront/locale (npm)
1 compromised version
- Jul 13, 2025
Malicious code in mgzfakee (npm)
2 compromised versions
- Jul 13, 2025
Malicious code in xpvnsulc (npm)
1 compromised version
- Jul 13, 2025
Malicious code in cbd2.1 (npm)
1 compromised version
- Jul 13, 2025
Malicious code in prospects (npm)
1 compromised version
- Jul 13, 2025
Malicious code in igshared (npm)
1 compromised version
- Jul 13, 2025
Malicious code in lscommons (npm)
1 compromised version
- Jul 13, 2025
Malicious code in lspushpage (npm)
2 compromised versions
- Jul 13, 2025
Malicious code in target_user_list (npm)
1 compromised version
- Jul 13, 2025
Malicious code in flow-playground (npm)
2 compromised versions
- Jul 12, 2025
Malicious code in fxa-auth-server (npm)
- Jul 12, 2025
Malicious code in realtime-demo (npm)
1 compromised version
- Jul 12, 2025
Malicious code in node-ts-cjs-auto (npm)
- Jul 12, 2025
Malicious code in model-providers (npm)
1 compromised version
- Jul 12, 2025
Malicious code in @0xzyo111/frontend-logger (npm)
2 compromised versions
- Jul 12, 2025
Malicious code in agent-patterns (npm)
- Jul 12, 2025
Malicious code in handoffs (npm)
- Jul 12, 2025
Malicious code in so-demo (npm)
- Jul 12, 2025
Malicious code in realtime-examples-2w (npm)
Page 5816 of 6,634