Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Feb 21, 2025
Malicious code in @visma-spcs-registry/react-common-components (npm)
2 compromised versions
- Feb 21, 2025
Malicious code in wdpr-test-package (npm)
1 compromised version
- Feb 21, 2025
Malicious code in wdpr-ra-node-mpropz (npm)
1 compromised version
- Feb 21, 2025
Malicious code in wasm-test-adapter (npm)
1 compromised version
- Feb 20, 2025
Malicious code in myconfusedfunctionpoctestpackage (npm)
2 compromised versions
- Feb 20, 2025
Malicious code in mygcpconfusedfunctionpoctestpackage (npm)
1 compromised version
- Feb 20, 2025
Malicious code in storyblok-rich-text-astro-renderer-workspace (npm)
1 compromised version
- Feb 19, 2025
Malicious code in @roku-web-ui/pills (npm)
1 compromised version
- Feb 19, 2025
Malicious code in @roku-web-ui/standard-footer (npm)
1 compromised version
- Feb 19, 2025
Malicious code in @roku-web-ui/modal (npm)
1 compromised version
- Feb 19, 2025
Malicious code in @supera/shared (npm)
3 compromised versions
- Feb 19, 2025
Malicious code in wkndaemassetcompute (npm)
1 compromised version
- Feb 19, 2025
Malware in mygcpconfusedfunctionpocmaliciouspackage
1 compromised version
- Feb 19, 2025
Malicious code in modulous (npm)
1 compromised version
- Feb 19, 2025
Malicious code in buzzblocks (npm)
1 compromised version
- Feb 19, 2025
Malware in pascoresend
1 compromised version
- Feb 19, 2025
Malware in modulous
1 compromised version
- Feb 19, 2025
Malware in theice
1 compromised version
- Feb 19, 2025
Malware in buzzblocks
1 compromised version
- Feb 19, 2025
Malicious code in string-width-aliased (npm)
- Feb 19, 2025
Malicious code in jquery-real (npm)
- Feb 19, 2025
Malicious code in jetpack-e2e-commons (npm)
- Feb 19, 2025
Malware in jquery-real
1 compromised version
- Feb 19, 2025
Malware in string-width-aliased
1 compromised version
- Feb 19, 2025
Malware in jetpack-e2e-commons
1 compromised version
- Feb 19, 2025
Malicious code in truecaller-profile-validation (npm)
2 compromised versions
- Feb 19, 2025
Malicious code in publish-private-provider-action (npm)
1 compromised version
- Feb 19, 2025
Malicious code in gurubu (npm)
4 compromised versions
- Feb 19, 2025
Malware in publish-private-provider-action
1 compromised version
- Feb 19, 2025
Malware in vhx-node-demo
1 compromised version
- Feb 19, 2025
Malware in truecaller-profile-validation
1 compromised version
- Feb 19, 2025
Malware in gurubu
1 compromised version
- Feb 19, 2025
Malware in vue-search-ui-demo
1 compromised version
- Feb 19, 2025
Malicious code in gutenberg-kit (npm)
1 compromised version
- Feb 19, 2025
Malicious code in go-bazel (npm)
1 compromised version
- Feb 19, 2025
Malware in go-bazel
1 compromised version
- Feb 19, 2025
Malware in gutenberg-kit
1 compromised version
- Feb 19, 2025
Malicious code in simulateur-gas (npm)
- Feb 19, 2025
Malicious code in simulateur-de-don (npm)
- Feb 19, 2025
Malicious code in get-gas-oracle (npm)
- Feb 19, 2025
Malicious code in gas-oracler (npm)
- Feb 19, 2025
Malware in gas-oracler
1 compromised version
- Feb 19, 2025
Malware in get-gas-oracle
1 compromised version
- Feb 19, 2025
Malware in simulateur-de-don
1 compromised version
- Feb 19, 2025
Malware in simulateur-gas
1 compromised version
- Feb 19, 2025
Malicious code in sally-fn (npm)
4 compromised versions
- Feb 19, 2025
Malware in sally-fn
1 compromised version
- Feb 19, 2025
Malicious code in schedulermpastakash (npm)
1 compromised version
- Feb 19, 2025
Malicious code in react-native-android-library-simpl-sdk (npm)
1 compromised version
- Feb 19, 2025
Malicious code in pinot-controller-ui (npm)
1 compromised version
Page 5959 of 6,634