Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,330 total in npm · sorted newest first- Mar 3, 2025
Malicious code in bybit-test (npm)
1 compromised version
- Mar 3, 2025
Malicious code in bybit-intenral (npm)
1 compromised version
- Mar 3, 2025
Malicious code in bybit-dev (npm)
1 compromised version
- Mar 3, 2025
Malicious code in business-kpi-manager-1.0.0 (npm)
11 compromised versions
- Mar 3, 2025
Malicious code in browser-data-collector (npm)
1 compromised version
- Mar 3, 2025
Malicious code in bookingcom-logger (npm)
1 compromised version
- Mar 3, 2025
Malicious code in bookingcom-jira (npm)
1 compromised version
- Mar 3, 2025
Malicious code in bookingcom-internal (npm)
1 compromised version
- Mar 3, 2025
Malicious code in bookingcom-gateway (npm)
1 compromised version
- Mar 3, 2025
Malicious code in bc-scroll-link (npm)
1 compromised version
- Mar 3, 2025
Malicious code in backpack-android (npm)
1 compromised version
- Mar 3, 2025
Malicious code in arcus-gradient-colors (npm)
1 compromised version
- Mar 3, 2025
Malicious code in arcus-gradient (npm)
1 compromised version
- Mar 3, 2025
Malicious code in apple-parser (npm)
1 compromised version
- Mar 3, 2025
Malicious code in apple-oauth (npm)
1 compromised version
- Mar 3, 2025
Malicious code in apple-model (npm)
1 compromised version
- Mar 3, 2025
Malicious code in apple-logger (npm)
1 compromised version
- Mar 3, 2025
Malicious code in apple-jira (npm)
1 compromised version
- Mar 3, 2025
Malicious code in apple-api-client (npm)
1 compromised version
- Mar 3, 2025
Malicious code in apple-analytics (npm)
1 compromised version
- Mar 3, 2025
Malicious code in apple-admin (npm)
1 compromised version
- Mar 3, 2025
Malicious code in api-nodejs-template (npm)
6 compromised versions
- Mar 3, 2025
Malicious code in amazon-utils (npm)
1 compromised version
- Mar 3, 2025
Malicious code in amazon-user (npm)
1 compromised version
- Mar 3, 2025
Malicious code in amazon-tools (npm)
1 compromised version
- Mar 3, 2025
Malicious code in amazon-tests (npm)
1 compromised version
- Mar 3, 2025
Malicious code in amazon-test (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in amazon-sync (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-sync (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-service (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-payment (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-model (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-logger (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-jira (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-internal (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in airbnb-gateway (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-event (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-db (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-database (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-connect (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-cloud (npm)
1 compromised version
- Mar 3, 2025
Malicious code in airbnb-checkout (npm)
1 compromised version
- Mar 3, 2025
Malicious code in accessbility (npm)
1 compromised version
- Mar 3, 2025
Malicious code in abstract-utxo (npm)
1 compromised version
- Mar 3, 2025
Malicious code in abstract-eth (npm)
1 compromised version
- Mar 3, 2025
Malicious code in 3952955c8e968410 (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @vfx-payment/transaction-summary (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in @transmit-security/ui (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in @smt-front/tracker (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @smt-front/poster (npm)
1 compromised version
Page 5963 of 6,647