Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Apr 2, 2025
Malware in nemo-dast-plugin
1 compromised version
- Apr 2, 2025
Malware in at-authorize-paypal
1 compromised version
- Apr 2, 2025
Malware in airbnb-dls-web
1 compromised version
- Apr 2, 2025
Malicious code in mahesh.dojo (npm)
1 compromised version
- Apr 2, 2025
Malicious code in @nationalgeographicsociety/ngsui-core-react (npm)
2 compromised versions
- Apr 2, 2025
Malware in mahesh.dojo
1 compromised version
- Apr 2, 2025
Malware in @nationalgeographicsociety/ngsui-core-react
1 compromised version
- Apr 2, 2025
Malicious code in lts-patterns (npm)
2 compromised versions
- Apr 2, 2025
Malicious code in @nationalgeographicsociety/ngsui-header-auth-provider-next (npm)
2 compromised versions
- Apr 2, 2025
Malicious code in @nationalgeographicsociety/ngsui-addons-react (npm)
2 compromised versions
- Apr 2, 2025
Malware in @nationalgeographicsociety/ngsui-header
1 compromised version
- Apr 2, 2025
Malware in lts-patterns
1 compromised version
- Apr 2, 2025
Malware in @nationalgeographicsociety/ngsui-footer
1 compromised version
- Apr 2, 2025
Malware in @nationalgeographicsociety/ngsui-addons-react
1 compromised version
- Apr 2, 2025
Malware in @nationalgeographicsociety/ngsui-header-auth-provider-next
1 compromised version
- Apr 2, 2025
Malicious code in @piplabs/story-contracts (npm)
1 compromised version
- Apr 2, 2025
Malicious code in blobstream-contracts (npm)
1 compromised version
- Apr 1, 2025
Malicious code in tap-hook (npm)
1 compromised version
- Apr 1, 2025
Malicious code in keypair-utils (npm)
- Apr 1, 2025
Malware in keypair-utils
1 compromised version
- Apr 1, 2025
Malicious code in snyk-malware-poc (npm)
3 compromised versions
- Mar 31, 2025
Malicious code in pocketnet (npm)
3 compromised versions
- Mar 31, 2025
Malicious code in yass_eal_abcdef_ssdsf_dsfsf (npm)
- Mar 31, 2025
Malicious code in saur-viseau-state-management (npm)
- Mar 31, 2025
Malicious code in saur-states-management (npm)
- Mar 31, 2025
Malicious code in saur-design-sys-web (npm)
- Mar 31, 2025
Malware in saur-viseau-state-management
1 compromised version
- Mar 31, 2025
Malware in saur-design-sys-web
1 compromised version
- Mar 31, 2025
Malware in yass_eal_abcdef_ssdsf_dsfsf
1 compromised version
- Mar 31, 2025
Malware in saur-states-management
1 compromised version
- Mar 31, 2025
Malicious code in @sas-dvr/ltjs-vav (npm)
2 compromised versions
- Mar 31, 2025
Malicious code in @sas-dvr/nova-crossorigin-auth (npm)
2 compromised versions
- Mar 31, 2025
Malicious code in @sas-dvr/ltjs-bird (npm)
2 compromised versions
- Mar 31, 2025
Malicious code in @sas-dvr/nova-graph (npm)
2 compromised versions
- Mar 31, 2025
Malicious code in @sas-dvr/ltjs-gtl (npm)
2 compromised versions
- Mar 31, 2025
Malicious code in ria-learninghub (npm)
2 compromised versions
- Mar 30, 2025
Malicious code in web-commerce-hook (npm)
1 compromised version
- Mar 30, 2025
Malicious code in nextmvc3primary (npm)
1 compromised version
- Mar 30, 2025
Malicious code in eqbank (npm)
2 compromised versions
- Mar 30, 2025
Malicious code in sony-liv-smarttv (npm)
1 compromised version
- Mar 30, 2025
Malicious code in regiepult (npm)
1 compromised version
- Mar 30, 2025
Malicious code in careform (npm)
1 compromised version
- Mar 30, 2025
Malicious code in rippling-marketing-site (npm)
2 compromised versions
- Mar 29, 2025
Malicious code in @nationalgeographicsociety/ngsui-header (npm)
2 compromised versions
- Mar 29, 2025
Malicious code in @nationalgeographicsociety/ngsui-footer (npm)
2 compromised versions
- Mar 29, 2025
Malicious code in castorama.pl (npm)
1 compromised version
- Mar 29, 2025
Malicious code in bugbounty208-test-package (npm)
1 compromised version
- Mar 28, 2025
Malicious code in agentbse (npm)
- Mar 28, 2025
Malware in agentbse
1 compromised version
- Mar 28, 2025
Malware in peritter
1 compromised version
Page 5913 of 6,634