Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Mar 3, 2025
Malware in paypal-sdk-server-side-integration
1 compromised version
- Mar 3, 2025
Malware in grpc-examples
1 compromised version
- Mar 3, 2025
Malware in eyeglass-multirepo
1 compromised version
- Mar 3, 2025
Malware in bindbc-sdl
1 compromised version
- Mar 3, 2025
Malware in traceviz-client-core
1 compromised version
- Mar 3, 2025
Malware in ossar-action
1 compromised version
- Mar 3, 2025
Malicious code in stripe-sample-accept-a-card-payment (npm)
- Mar 3, 2025
Malicious code in safe-settings (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in dependabot-pull-request-action (npm)
- Mar 3, 2025
Malicious code in ct-connect-stripe (npm)
- Mar 3, 2025
Malicious code in checkout-one-time-payments (npm)
- Mar 3, 2025
Malicious code in bindbc-lua (npm)
- Mar 3, 2025
Malicious code in animated_vector_annotations (npm)
- Mar 3, 2025
Malicious code in accept-a-payment-playwright-testing (npm)
- Mar 3, 2025
Malicious code in accept-a-payment (npm)
- Mar 3, 2025
Malicious code in stripe-sample-accept-a-payment (npm)
3 compromised versions
- Mar 3, 2025
Malware in bindbc-lua
1 compromised version
- Mar 3, 2025
Malware in accept-a-payment
1 compromised version
- Mar 3, 2025
Malware in ct-connect-stripe
1 compromised version
- Mar 3, 2025
Malware in dependabot-pull-request-action
1 compromised version
- Mar 3, 2025
Malware in checkout-one-time-payments
1 compromised version
- Mar 3, 2025
Malware in animated_vector_annotations
1 compromised version
- Mar 3, 2025
Malware in safe-settings
1 compromised version
- Mar 3, 2025
Malware in stripe-sample-accept-a-card-payment
1 compromised version
- Mar 3, 2025
Malware in accept-a-payment-playwright-testing
1 compromised version
- Mar 3, 2025
Malware in stripe-sample-accept-a-payment
1 compromised version
- Mar 3, 2025
Malware in aws-iot-samples-util
1 compromised version
- Mar 3, 2025
Malware in vscode-dotnet-sdk
1 compromised version
- Mar 3, 2025
Malware in trace-production
1 compromised version
- Mar 3, 2025
Malicious code in decode-a-gif (npm)
- Mar 3, 2025
Malicious code in lowerlatency (npm)
21 compromised versions
- Mar 3, 2025
Malicious code in initidiscord (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in init-discord (npm)
1 compromised version
- Mar 3, 2025
Malware in init-discord
1 compromised version
- Mar 3, 2025
Malware in decode-a-gif
1 compromised version
- Mar 3, 2025
Malware in initidiscord
1 compromised version
- Mar 3, 2025
Malware in lowerlatency
1 compromised version
- Mar 3, 2025
Malicious code in consumer-platform-global-package (npm)
1 compromised version
- Mar 3, 2025
Malware in consumer-platform-global-package
1 compromised version
- Mar 3, 2025
Malicious code in @optimystic99/test2 (npm)
- Mar 3, 2025
Malicious code in @optimystic99/dev-utils-2 (npm)
- Mar 3, 2025
Malware in @optimystic99/test2
1 compromised version
- Mar 3, 2025
Malware in @optimystic99/dev-utils-2
1 compromised version
- Mar 3, 2025
Malicious code in snap-design-system-icons (npm)
5 compromised versions
- Mar 3, 2025
Malicious code in bahamazing (npm)
1 compromised version
- Mar 2, 2025
Malicious code in reproduction-hardhat (npm)
1 compromised version
- Mar 2, 2025
Malicious code in rdocs-light (npm)
1 compromised version
- Mar 2, 2025
Malicious code in react-native-survicate (npm)
1 compromised version
- Mar 2, 2025
Malicious code in metrics-aggregator (npm)
1 compromised version
- Mar 2, 2025
Malicious code in ad-creative-preview (npm)
1 compromised version
Page 5953 of 6,634