Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Mar 5, 2025
Malware in iff-root
1 compromised version
- Mar 5, 2025
Malware in amagi-kanban
1 compromised version
- Mar 5, 2025
Malware in fdc3-web-monorepo
1 compromised version
- Mar 5, 2025
Malware in onyx-ssi-sdk-examples
1 compromised version
- Mar 5, 2025
Malware in azure_monitor_workbook_templates
1 compromised version
- Mar 5, 2025
Malware in innersource-sig
1 compromised version
- Mar 5, 2025
Malware in figma-plugins-and-widgets
1 compromised version
- Mar 5, 2025
Malware in battleships-player
1 compromised version
- Mar 5, 2025
Malware in react-component-usage
1 compromised version
- Mar 5, 2025
Malware in eslint-plugin-externalincludes
1 compromised version
- Mar 5, 2025
Malware in tablegen
1 compromised version
- Mar 5, 2025
Malware in esm-appdynamics-grafana-react-datasource
1 compromised version
- Mar 5, 2025
Malware in morganstanley.github.io
1 compromised version
- Mar 5, 2025
Malware in node-unzip
1 compromised version
- Mar 5, 2025
Malware in makerspace-cpx-intro
1 compromised version
- Mar 5, 2025
Malware in azure-sdk-tools
1 compromised version
- Mar 5, 2025
Malware in ccf-identity
1 compromised version
- Mar 5, 2025
Malware in archon5
1 compromised version
- Mar 5, 2025
Malware in my-archon
1 compromised version
- Mar 5, 2025
Malware in archon1
1 compromised version
- Mar 5, 2025
Malware in archon2
1 compromised version
- Mar 5, 2025
Malware in archon6
1 compromised version
- Mar 5, 2025
Malware in edubrite
1 compromised version
- Mar 5, 2025
Malware in fluentui-repo
1 compromised version
- Mar 5, 2025
Malware in archon7
1 compromised version
- Mar 5, 2025
Malware in archon4
1 compromised version
- Mar 5, 2025
Malware in archon3
1 compromised version
- Mar 5, 2025
Malicious code in idme-component-utilities (npm)
1 compromised version
- Mar 5, 2025
Malicious code in api-discord.js-v14 (npm)
- Mar 5, 2025
Malware in api-discord.js-v14
1 compromised version
- Mar 5, 2025
Malicious code in internoapi-rota (npm)
- Mar 5, 2025
Malicious code in hookform-resolvers (npm)
- Mar 5, 2025
Malware in internoapi-rota
1 compromised version
- Mar 5, 2025
Malware in hookform-resolvers
1 compromised version
- Mar 5, 2025
Malicious code in vscode-ps1 (npm)
- Mar 5, 2025
Malicious code in totem-project-website (npm)
1 compromised version
- Mar 5, 2025
Malicious code in sdk-playground (npm)
- Mar 5, 2025
Malicious code in paymaster-bundler-examples (npm)
- Mar 5, 2025
Malicious code in ncw-eddsa-signing (npm)
1 compromised version
- Mar 5, 2025
Malicious code in jquery-suggestable (npm)
1 compromised version
- Mar 5, 2025
Malicious code in edx-monitoring-only (npm)
1 compromised version
- Mar 5, 2025
Malicious code in discord_quick2 (npm)
1 compromised version
- Mar 5, 2025
Malicious code in alexpavlov--jquery-suggestable (npm)
1 compromised version
- Mar 5, 2025
Malicious code in aave-v3-crosschain-listing-template (npm)
- Mar 5, 2025
Malware in edx-monitoring-only
1 compromised version
- Mar 5, 2025
Malware in paymaster-bundler-examples
1 compromised version
- Mar 5, 2025
Malware in sdk-playground
1 compromised version
- Mar 5, 2025
Malware in discord_quick2
1 compromised version
- Mar 5, 2025
Malware in jquery-suggestable
1 compromised version
- Mar 5, 2025
Malware in vscode-ps1
1 compromised version
Page 5941 of 6,634