Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.text-area (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.tags.tags-status (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.tags.tags-counter (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.tags.tags (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.tabs (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.table-cells.tc-tags-status (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.table-cells.tc-icon-list (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.table-cells.tc-icon-button (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.table-cells.tc-icon (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.table-cells.tc-header (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.table-cells.tc-data (npm)
1 compromised version
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.table-cells.tc-cell (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.table-cells.tc-avatars (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.surface (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.stepper (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.snackbar (npm)
1 compromised version
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.shell-loading (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.search (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.radio-group (npm)
1 compromised version
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.radio (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.progress-line (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.progress-circle (npm)
1 compromised version
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.popout (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.pagination (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.list-item.list-item-dropdown (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.list-item.list-item (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.link (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.input (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.icon-element (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.icon-button (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.icon (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.header (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.footer (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.file-uploader (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.extras (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.empty-state (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.dropdown (npm)
1 compromised version
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.drawer (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.divider (npm)
1 compromised version
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.dialog (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.design-tokens (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.date-picker.time-picker (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.date-picker.date-time-picker (npm)
1 compromised version
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.date-picker.date-picker (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.datatable (npm)
1 compromised version
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.controller (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.console (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.composition-wrapper (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.chip (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.checkbox (npm)
2 compromised versions
Page 5901 of 6,634