Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Feb 19, 2025
Malicious code in norequest-akash (npm)
1 compromised version
- Feb 19, 2025
Malicious code in list-files-in-pr (npm)
1 compromised version
- Feb 19, 2025
Malware in list-files-in-pr
1 compromised version
- Feb 19, 2025
Malware in pinot-controller-ui
1 compromised version
- Feb 19, 2025
Malware in security-admin
1 compromised version
- Feb 19, 2025
Malware in norequest-akash
1 compromised version
- Feb 19, 2025
Malware in testbyakash2310xxxxxxxnowaympasti
1 compromised version
- Feb 19, 2025
Malware in react-native-simpl
1 compromised version
- Feb 19, 2025
Malware in kubernetes-jobs-javascript
1 compromised version
- Feb 19, 2025
Malware in schedulermpastakash
1 compromised version
- Feb 19, 2025
Malware in react-native-android-library-simpl-sdk
1 compromised version
- Feb 19, 2025
Malicious code in byted-player-service (npm)
- Feb 19, 2025
Malicious code in byted-player (npm)
- Feb 19, 2025
Malware in byted-player-service
1 compromised version
- Feb 19, 2025
Malware in byted-player
1 compromised version
- Feb 19, 2025
Malicious code in upm-ci-utils-tes-t (npm)
- Feb 19, 2025
Malware in upm-ci-utils-tes-t
1 compromised version
- Feb 19, 2025
Malicious code in jquery.validate.additional-methods-br (npm)
4 compromised versions
- Feb 19, 2025
Malware in jquery.validate.additional-methods-br
1 compromised version
- Feb 19, 2025
Malicious code in type-grid-extra (npm)
- Feb 19, 2025
Malware in type-grid-extra
1 compromised version
- Feb 19, 2025
Malicious code in @idps/contrib-client (npm)
- Feb 19, 2025
Malware in @idps/contrib-client
1 compromised version
- Feb 19, 2025
Malicious code in fohost (npm)
- Feb 19, 2025
Malware in fohost
1 compromised version
- Feb 19, 2025
Malicious code in opensource.razorpay.dev (npm)
1 compromised version
- Feb 19, 2025
Malware in opensource.razorpay.dev
1 compromised version
- Feb 19, 2025
Malicious code in unmoderated (npm)
1 compromised version
- Feb 19, 2025
Malware in mattermost-cloudnative-bootstrapper
1 compromised version
- Feb 19, 2025
Malware in orderly-web
1 compromised version
- Feb 19, 2025
Malware in action-mattermost-notify
1 compromised version
- Feb 19, 2025
Malware in uchiwa-web
1 compromised version
- Feb 19, 2025
Malware in flame-monorepo
1 compromised version
- Feb 19, 2025
Malware in openai-realtime-console
1 compromised version
- Feb 19, 2025
Malware in ml-interactive-data-augmentation
1 compromised version
- Feb 19, 2025
Malware in rsd-monorepo
1 compromised version
- Feb 19, 2025
Malware in unmoderated
1 compromised version
- Feb 19, 2025
Malware in web-actions-v4
1 compromised version
- Feb 19, 2025
Malware in isctf11
1 compromised version
- Feb 19, 2025
Malware in isctf4
1 compromised version
- Feb 19, 2025
Malware in isctf16
1 compromised version
- Feb 19, 2025
Malware in isctf2
1 compromised version
- Feb 19, 2025
Malware in is-number-ctf
1 compromised version
- Feb 19, 2025
Malware in isctf5
1 compromised version
- Feb 19, 2025
Malware in isctf3
1 compromised version
- Feb 19, 2025
Malware in isctf17
1 compromised version
- Feb 18, 2025
Malicious code in mygcpconfusedfunctionpocmaliciouspackage (npm)
3 compromised versions
- Feb 18, 2025
Malicious code in elastic-buildkite-manager (npm)
1 compromised version
- Feb 18, 2025
Malicious code in @xenial-ux/services (npm)
1 compromised version
- Feb 18, 2025
Malicious code in react-spectrum-monorepo (npm)
1 compromised version
Page 5960 of 6,634