Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 21, 2025
Malicious code in selfbot-rpc (npm)
1 compromised version
- May 21, 2025
Malicious code in rpc-selffbottt (npm)
1 compromised version
- May 21, 2025
Malicious code in rpc-selffbott (npm)
1 compromised version
- May 21, 2025
Malicious code in rpc-selffbot (npm)
1 compromised version
- May 21, 2025
Malicious code in rpc-selfbottt (npm)
1 compromised version
- May 21, 2025
Malicious code in rpc-selfbot-v10 (npm)
- May 21, 2025
Malicious code in rpc-selfb0t (npm)
3 compromised versions
- May 21, 2025
Malware in rpc-selffbot
1 compromised version
- May 21, 2025
Malware in rpc-selfbot-v10
1 compromised version
- May 21, 2025
Malware in rpc-selfbottt
1 compromised version
- May 21, 2025
Malware in selfbot-rpc
1 compromised version
- May 21, 2025
Malware in rpc-selffbottt
1 compromised version
- May 21, 2025
Malware in selfbot-test-2
1 compromised version
- May 21, 2025
Malware in web3walletconnect
1 compromised version
- May 21, 2025
Malware in rpc-selfb0t
1 compromised version
- May 21, 2025
Malware in web3walletconnet
1 compromised version
- May 21, 2025
Malware in selfbot-v1
1 compromised version
- May 21, 2025
Malware in selfbott-rpc
1 compromised version
- May 21, 2025
Malware in web3automation
1 compromised version
- May 21, 2025
Malware in selfbot-v2
1 compromised version
- May 21, 2025
Malware in rpc-selffbott
1 compromised version
- May 21, 2025
Malicious code in whatsapp-flows-endpoint (npm)
1 compromised version
- May 21, 2025
Malicious code in pro-article-context (npm)
- May 21, 2025
Malware in whatsapp-flows-endpoint
1 compromised version
- May 21, 2025
Malware in pro-article-context
1 compromised version
- May 20, 2025
Malicious code in shaktihacker (npm)
- May 20, 2025
Malicious code in coreapi-export-template (npm)
5 compromised versions
- May 20, 2025
Malicious code in firewall-node (npm)
2 compromised versions
- May 20, 2025
Malicious code in passport-approved-token (npm)
- May 20, 2025
Malware in passport-approved-token
1 compromised version
- May 20, 2025
Malicious code in discord-clients (npm)
3 compromised versions
- May 20, 2025
Malware in discord-clients
1 compromised version
- May 20, 2025
Malicious code in web3-provider-wallet (npm)
- May 20, 2025
Malware in web3-provider-wallet
1 compromised version
- May 20, 2025
Malicious code in web3connectjs (npm)
- May 20, 2025
Malicious code in hashcrypt265 (npm)
1 compromised version
- May 20, 2025
Malicious code in evm-validator (npm)
- May 20, 2025
Malware in web3connectjs
1 compromised version
- May 20, 2025
Malware in hashcrypt265
1 compromised version
- May 20, 2025
Malware in evm-validator
1 compromised version
- May 19, 2025
Malicious code in ort-web-template (npm)
1 compromised version
- May 19, 2025
Malicious code in service-catalog-copilot (npm)
1 compromised version
- May 19, 2025
Malicious code in conventional-changelog-tf-a (npm)
1 compromised version
- May 19, 2025
Malicious code in @abb-ux/commonux-web-components (npm)
2 compromised versions
- May 19, 2025
Malicious code in trusted-firmware-a (npm)
2 compromised versions
- May 19, 2025
Malicious code in wallet1-options (npm)
1 compromised version
- May 19, 2025
Malicious code in @act-platform/app-sdk (npm)
3 compromised versions
- May 19, 2025
Malicious code in fireblocks-netlink-v2-api-validator (npm)
4 compromised versions
- May 19, 2025
Malicious code in vtex.google-tag-manager (npm)
- May 19, 2025
Malicious code in internallib_v473 (npm)
Page 5877 of 6,634