Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,330 total in npm · sorted newest first- Mar 3, 2025
Malicious code in instacart-api-client (npm)
1 compromised version
- Mar 3, 2025
Malicious code in instacart-api (npm)
1 compromised version
- Mar 3, 2025
Malicious code in instacart-analytics (npm)
1 compromised version
- Mar 3, 2025
Malicious code in instacart-admin (npm)
1 compromised version
- Mar 3, 2025
Malicious code in ingest-demo (npm)
1 compromised version
- Mar 3, 2025
Malicious code in ing-shared-navigation (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-utils (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-user (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-tools (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-tests (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-oauth (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-model (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-logger (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-jira (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-internal (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-gateway (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-event (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-db (npm)
1 compromised version
- Mar 3, 2025
Malicious code in iberia-database (npm)
1 compromised version
- Mar 3, 2025
Malicious code in hexoffsectest (npm)
1 compromised version
- Mar 3, 2025
Malicious code in happychat-connection (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in google-user (npm)
1 compromised version
- Mar 3, 2025
Malicious code in google-tests (npm)
1 compromised version
- Mar 3, 2025
Malicious code in google-test (npm)
1 compromised version
- Mar 3, 2025
Malicious code in google-sync (npm)
1 compromised version
- Mar 3, 2025
Malicious code in google-sdk (npm)
1 compromised version
- Mar 3, 2025
Malicious code in google-payment (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in google-model (npm)
1 compromised version
- Mar 3, 2025
Malicious code in google-logger (npm)
1 compromised version
- Mar 3, 2025
Malicious code in google-jira (npm)
1 compromised version
- Mar 3, 2025
Malicious code in google-internal (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in google-gateway (npm)
1 compromised version
- Mar 3, 2025
Malicious code in google-event (npm)
1 compromised version
- Mar 3, 2025
Malicious code in google-db (npm)
1 compromised version
- Mar 3, 2025
Malicious code in godaddy-payment (npm)
1 compromised version
- Mar 3, 2025
Malicious code in godaddy-parser (npm)
1 compromised version
- Mar 3, 2025
Malicious code in godaddy-oauth (npm)
1 compromised version
- Mar 3, 2025
Malicious code in godaddy-database (npm)
1 compromised version
- Mar 3, 2025
Malicious code in godaddy-connect (npm)
1 compromised version
- Mar 3, 2025
Malicious code in fp-persoonlijke-pas (npm)
1 compromised version
- Mar 3, 2025
Malicious code in foxy-node-google-pay-decrypt (npm)
3 compromised versions
- Mar 3, 2025
Malicious code in flux-common-plugin (npm)
3 compromised versions
- Mar 3, 2025
Malicious code in explat-client-react-helpers (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in explat-client (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in eslint-plugin-wpvip (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in epicagames-test (npm)
1 compromised version
- Mar 3, 2025
Malicious code in epicagames-sync (npm)
1 compromised version
- Mar 3, 2025
Malicious code in epicagames-service (npm)
1 compromised version
- Mar 3, 2025
Malicious code in epicagames-sdk (npm)
1 compromised version
- Mar 3, 2025
Malicious code in epicagames-db (npm)
1 compromised version
Page 5961 of 6,647