Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 23, 2025
Malware in gear-idea-indexer-db
1 compromised version
- May 23, 2025
Malware in com.unity.visualeffectgraph
1 compromised version
- May 23, 2025
Malware in blog-client
1 compromised version
- May 23, 2025
Malware in com.unity.rendering.light-transport
1 compromised version
- May 23, 2025
Malware in com.unity.robotics.warehouse.base
1 compromised version
- May 23, 2025
Malware in com.unity.live-capture
1 compromised version
- May 23, 2025
Malware in gear-idea-common
1 compromised version
- May 23, 2025
Malware in com.unity.furioos-connection-kit
1 compromised version
- May 23, 2025
Malware in com.unity.cloud.common
1 compromised version
- May 23, 2025
Malware in @demoability/loadgen-core
1 compromised version
- May 23, 2025
Malware in @elementor-editor-github-actions/utils
1 compromised version
- May 23, 2025
Malware in com.unity.perception
1 compromised version
- May 23, 2025
Malware in com.unity.platforms
1 compromised version
- May 23, 2025
Malware in @nitro2/shared
1 compromised version
- May 23, 2025
Malware in com.unity.ml-agents
1 compromised version
- May 23, 2025
Malware in com.unity.rpc
1 compromised version
- May 23, 2025
Malware in com.unity.render-pipelines.universal-config
1 compromised version
- May 23, 2025
Malware in com.unity.multiplayer.tools
1 compromised version
- May 23, 2025
Malicious code in jquery.currencies (npm)
2 compromised versions
- May 23, 2025
Malicious code in com.unity.xr-line-renderer (npm)
1 compromised version
- May 23, 2025
Malicious code in com.unity.renderstreaming (npm)
1 compromised version
- May 23, 2025
Malicious code in com.unity.netcode.gameobjects (npm)
1 compromised version
- May 23, 2025
Malicious code in com.unity.jobs (npm)
1 compromised version
- May 23, 2025
Malicious code in com.unity.hlod (npm)
1 compromised version
- May 23, 2025
Malicious code in com.unity.code-analysis (npm)
1 compromised version
- May 23, 2025
Malicious code in com.unity.build-report-inspector (npm)
1 compromised version
- May 23, 2025
Malicious code in agic-code-standards (npm)
1 compromised version
- May 23, 2025
Malicious code in @sl4x0/internal-package (npm)
- May 23, 2025
Malware in com.unity.build-report-inspector
1 compromised version
- May 23, 2025
Malware in com.unity.xr-line-renderer
1 compromised version
- May 23, 2025
Malware in com.unity.list-view-framework
1 compromised version
- May 23, 2025
Malware in com.unity.netcode.gameobjects
1 compromised version
- May 23, 2025
Malware in jquery.currencies
1 compromised version
- May 23, 2025
Malware in com.unity.formats.fbx
1 compromised version
- May 23, 2025
Malware in agic-code-standards
1 compromised version
- May 23, 2025
Malware in com.unity.scripting.python
1 compromised version
- May 23, 2025
Malware in com.unity.cluster-display
1 compromised version
- May 23, 2025
Malware in com.unity.code-analysis
1 compromised version
- May 23, 2025
Malware in com.unity.jobs
1 compromised version
- May 23, 2025
Malware in com.unity.renderstreaming
1 compromised version
- May 23, 2025
Malware in @sl4x0/internal-package
1 compromised version
- May 23, 2025
Malware in com.unity.hlod
1 compromised version
- May 22, 2025
Malicious code in nb-tsconfig (npm)
- May 22, 2025
Malicious code in vishal-plugin-flipper (npm)
- May 22, 2025
Malicious code in starknet-types-07 (npm)
2 compromised versions
- May 22, 2025
Malicious code in random-dupa-test-1 (npm)
2 compromised versions
- May 22, 2025
Malware in starknet-types-07
1 compromised version
- May 22, 2025
Malware in random-dupa-test-1
1 compromised version
- May 22, 2025
Malicious code in primereact-sass-theme (npm)
- May 22, 2025
Malicious code in twilio-realtime-frontend (npm)
1 compromised version
Page 5871 of 6,634