Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 23, 2025
Malware in gatsby-plugin-source-map
1 compromised version
- May 23, 2025
Malicious code in zzr-react-custom-widget (npm)
- May 23, 2025
Malicious code in my-check-inline-loader-plugin (npm)
- May 23, 2025
Malware in my-check-inline-loader-plugin
1 compromised version
- May 23, 2025
Malware in zzr-react-custom-widget
1 compromised version
- May 23, 2025
Malicious code in greetpk (npm)
- May 23, 2025
Malicious code in fs-path-info (npm)
- May 23, 2025
Malicious code in btcjs-lib (npm)
4 compromised versions
- May 23, 2025
Malware in btcjs-lib
1 compromised version
- May 23, 2025
Malware in greetpk
1 compromised version
- May 23, 2025
Malware in fs-path-info
1 compromised version
- May 23, 2025
Malicious code in mockup-plugin (npm)
3 compromised versions
- May 23, 2025
Malware in mockup-plugin
1 compromised version
- May 23, 2025
Malicious code in internalwkl-1 (npm)
5 compromised versions
- May 23, 2025
Malware in internalwkl-1
1 compromised version
- May 23, 2025
Malicious code in giftcards (npm)
- May 23, 2025
Malicious code in gcfront (npm)
- May 23, 2025
Malicious code in fc-card-overview (npm)
1 compromised version
- May 23, 2025
Malicious code in fc-accordion (npm)
1 compromised version
- May 23, 2025
Malicious code in document-list-extra-questions (npm)
1 compromised version
- May 23, 2025
Malicious code in client-microsite-reactjs-controls (npm)
1 compromised version
- May 23, 2025
Malicious code in client-file-manager-module (npm)
1 compromised version
- May 23, 2025
Malicious code in client-controls-module (npm)
1 compromised version
- May 23, 2025
Malicious code in client-authentication-module (npm)
1 compromised version
- May 23, 2025
Malware in fc-accordion
1 compromised version
- May 23, 2025
Malware in client-controls-module
1 compromised version
- May 23, 2025
Malware in giftcards
1 compromised version
- May 23, 2025
Malware in fc-card-overview
1 compromised version
- May 23, 2025
Malware in gcfront
1 compromised version
- May 23, 2025
Malware in client-authentication-module
1 compromised version
- May 23, 2025
Malware in client-file-manager-module
1 compromised version
- May 23, 2025
Malware in client-microsite-reactjs-controls
1 compromised version
- May 23, 2025
Malware in document-list-extra-questions
1 compromised version
- May 23, 2025
Malicious code in user-auth-prod (npm)
1 compromised version
- May 23, 2025
Malicious code in payment-gateway-internal (npm)
2 compromised versions
- May 23, 2025
Malicious code in mtfe_cos_track (npm)
1 compromised version
- May 23, 2025
Malicious code in jitsi-meet-sdk (npm)
2 compromised versions
- May 23, 2025
Malicious code in creditkarma-us (npm)
1 compromised version
- May 23, 2025
Malicious code in child-youth-promotion-banner (npm)
1 compromised version
- May 23, 2025
Malicious code in cardbuild (npm)
1 compromised version
- May 23, 2025
Malicious code in badoo-frontend (npm)
1 compromised version
- May 23, 2025
Malware in payment-gateway-internal
1 compromised version
- May 23, 2025
Malware in badoo-frontend
1 compromised version
- May 23, 2025
Malware in cardbuild
1 compromised version
- May 23, 2025
Malware in mtfe_cos_track
1 compromised version
- May 23, 2025
Malware in atlaskit-registry
1 compromised version
- May 23, 2025
Malware in user-auth-prod
1 compromised version
- May 23, 2025
Malware in creditkarma-us
1 compromised version
- May 23, 2025
Malware in child-youth-promotion-banner
1 compromised version
- May 23, 2025
Malware in jitsi-meet-sdk
1 compromised version
Page 5867 of 6,634