Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Mar 3, 2025
Malicious code in react-dom-v18 (npm)
1 compromised version
- Mar 3, 2025
Malicious code in rallyslack (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in probe-dictionary-mozilla (npm)
1 compromised version
- Mar 3, 2025
Malicious code in pie-monorepo (npm)
1 compromised version
- Mar 3, 2025
Malicious code in paypal-expanded-integration-backend-node (npm)
1 compromised version
- Mar 3, 2025
Malicious code in pattern-picker (npm)
1 compromised version
- Mar 3, 2025
Malicious code in page-pattern-modal (npm)
1 compromised version
- Mar 3, 2025
Malicious code in owl.carousel.custom (npm)
9 compromised versions
- Mar 3, 2025
Malicious code in orderly-js-sdk-cra-template (npm)
1 compromised version
- Mar 3, 2025
Malicious code in okt-scripts (npm)
1 compromised version
- Mar 3, 2025
Malicious code in oj-sp-attachments-common (npm)
1 compromised version
- Mar 3, 2025
Malicious code in nflx-metaflow (npm)
4 compromised versions
- Mar 3, 2025
Malicious code in mev-sdk (npm)
1 compromised version
- Mar 3, 2025
Malicious code in metamask-sdk-e2e (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meta-event (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meta-connect (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meta-checkout (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meta-cache (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meta-api-client (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meta-analytics (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meli-utils (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meli-user (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meli-tools (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meli-tests (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meli-test (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meli-service (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meli-payment (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meli-parser (npm)
1 compromised version
- Mar 3, 2025
Malicious code in meli-oauth (npm)
1 compromised version
- Mar 3, 2025
Malicious code in mapsapi-polylabeler (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in mapbox-demo-components (npm)
1 compromised version
- Mar 3, 2025
Malicious code in malware-testbed (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in lyft-service (npm)
1 compromised version
- Mar 3, 2025
Malicious code in linkedin-test (npm)
1 compromised version
- Mar 3, 2025
Malicious code in linkedin-sync (npm)
1 compromised version
- Mar 3, 2025
Malicious code in linkedin-service (npm)
1 compromised version
- Mar 3, 2025
Malicious code in linkedin-sdk (npm)
1 compromised version
- Mar 3, 2025
Malicious code in linkedin-payment (npm)
1 compromised version
- Mar 3, 2025
Malicious code in linkedin-parser (npm)
1 compromised version
- Mar 3, 2025
Malicious code in linkedin-model (npm)
1 compromised version
- Mar 3, 2025
Malicious code in linkedin-logger (npm)
1 compromised version
- Mar 3, 2025
Malicious code in linkedin-jira (npm)
1 compromised version
- Mar 3, 2025
Malicious code in linkedin-internal (npm)
1 compromised version
- Mar 3, 2025
Malicious code in linkedin-gateway (npm)
1 compromised version
- Mar 3, 2025
Malicious code in linkedin-db (npm)
1 compromised version
- Mar 3, 2025
Malicious code in leafygreen-ui (npm)
1 compromised version
- Mar 3, 2025
Malicious code in instacart-tools (npm)
1 compromised version
- Mar 3, 2025
Malicious code in instacart-tests (npm)
1 compromised version
- Mar 3, 2025
Malicious code in instacart-test (npm)
1 compromised version
- Mar 3, 2025
Malicious code in instacart-sync (npm)
1 compromised version
Page 5947 of 6,634