Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,330 total in npm · sorted newest first- Feb 28, 2025
Malware in react-content-loader-fork
1 compromised version
- Feb 28, 2025
Malware in emailconfirmationserv
1 compromised version
- Feb 28, 2025
Malware in merchanttoolserv
1 compromised version
- Feb 28, 2025
Malware in userread_ca-paypal
1 compromised version
- Feb 28, 2025
Malicious code in mailu (npm)
1 compromised version
- Feb 28, 2025
Malware in bqtop
1 compromised version
- Feb 28, 2025
Malware in gslack
1 compromised version
- Feb 28, 2025
Malware in explore-assistant
1 compromised version
- Feb 28, 2025
Malware in flow-inflation-client
1 compromised version
- Feb 28, 2025
Malware in quickwit-ui
1 compromised version
- Feb 28, 2025
Malware in mailu
1 compromised version
- Feb 28, 2025
Malware in realtimeboard
1 compromised version
- Feb 28, 2025
Malware in honeybook-marketing-gatsby
1 compromised version
- Feb 28, 2025
Malicious code in org.cocoapods.mosaicui (npm)
4 compromised versions
- Feb 28, 2025
Malicious code in exclusiveminimum (npm)
1 compromised version
- Feb 28, 2025
Malicious code in exclusivemaximum (npm)
1 compromised version
- Feb 28, 2025
Malware in org.cocoapods.csv
1 compromised version
- Feb 28, 2025
Malware in exclusiveminimum
1 compromised version
- Feb 28, 2025
Malware in exclusivemaximum
1 compromised version
- Feb 28, 2025
Malware in org.cocoapods.mosaicui
1 compromised version
- Feb 28, 2025
Malware in multirpc-sdk
1 compromised version
- Feb 28, 2025
Malware in @visma-spcs-registry/react-common-components
1 compromised version
- Feb 28, 2025
Malicious code in tedrertrtrtst (npm)
- Feb 28, 2025
Malicious code in ragbot-starter (npm)
- Feb 28, 2025
Malicious code in liquidity-bridge-contract (npm)
- Feb 28, 2025
Malicious code in harper-web (npm)
- Feb 28, 2025
Malicious code in aem-headless-web-component (npm)
- Feb 28, 2025
Malware in keycloak-theme
1 compromised version
- Feb 28, 2025
Malware in jaas-jwt
1 compromised version
- Feb 28, 2025
Malware in ragbot-starter
1 compromised version
- Feb 28, 2025
Malware in spectrum-css-monorepo
1 compromised version
- Feb 28, 2025
Malware in tedrertrtrtst
1 compromised version
- Feb 28, 2025
Malware in liquidity-bridge-contract
1 compromised version
- Feb 28, 2025
Malware in uyurettrtrtst
1 compromised version
- Feb 28, 2025
Malware in harper-web
1 compromised version
- Feb 28, 2025
Malware in tesdf45454t
1 compromised version
- Feb 28, 2025
Malware in aem-headless-web-component
1 compromised version
- Feb 28, 2025
Malicious code in ufarm-evm-contracts (npm)
1 compromised version
- Feb 28, 2025
Malicious code in vite_ruby_monorepo (npm)
3 compromised versions
- Feb 28, 2025
Malicious code in huma-contracts-v2 (npm)
1 compromised version
- Feb 28, 2025
Malicious code in all.en.js (npm)
- Feb 28, 2025
Malware in all.en.js
1 compromised version
- Feb 28, 2025
Malicious code in react-native-wallet-sdk-demo-app (npm)
1 compromised version
- Feb 28, 2025
Malicious code in azure_monitor_workbook_templates (npm)
2 compromised versions
- Feb 27, 2025
Malicious code in @c11-lib-ts/document-handler (npm)
1 compromised version
- Feb 27, 2025
Malicious code in fluentui-repo (npm)
1 compromised version
- Feb 23, 2025
Malicious code in main-branch-check (npm)
1 compromised version
- Feb 23, 2025
Malicious code in realtime-examples (npm)
1 compromised version
- Feb 23, 2025
Malicious code in twilio-realtime (npm)
1 compromised version
- Feb 23, 2025
Malicious code in edubrite (npm)
1 compromised version
Page 5970 of 6,647