Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Feb 7, 2025
Malicious code in vhx-node-demo (npm)
1 compromised version
- Feb 7, 2025
Malicious code in hcpss (npm)
1 compromised version
- Feb 7, 2025
Malicious code in trufflevscode (npm)
1 compromised version
- Feb 7, 2025
Malware in trufflevscode
1 compromised version
- Feb 7, 2025
Malicious code in nodex123 (npm)
- Feb 7, 2025
Malware in nodex123
1 compromised version
- Feb 7, 2025
Malicious code in ing-feat-oct-components (npm)
1 compromised version
- Feb 7, 2025
Malware in dx-hotels-ui
1 compromised version
- Feb 7, 2025
Malware in ing-feat-oct-components
1 compromised version
- Feb 7, 2025
Malware in roro3
1 compromised version
- Feb 7, 2025
Malware in roro1
1 compromised version
- Feb 7, 2025
Malware in roro2
1 compromised version
- Feb 7, 2025
Malware in codat
1 compromised version
- Feb 7, 2025
Malware in securedrop
1 compromised version
- Feb 7, 2025
Malware in awsume
1 compromised version
- Feb 7, 2025
Malware in twilio.github.io
1 compromised version
- Feb 7, 2025
Malware in requests-async
1 compromised version
- Feb 7, 2025
Malware in bookingcom-database
1 compromised version
- Feb 7, 2025
Malware in bookingcom-cloud
1 compromised version
- Feb 7, 2025
Malware in bookingcom-connect
1 compromised version
- Feb 7, 2025
Malware in bookingcom-api-client
1 compromised version
- Feb 7, 2025
Malware in bookingcom-event
1 compromised version
- Feb 7, 2025
Malware in bookingcom-db
1 compromised version
- Feb 7, 2025
Malware in bookingcom-cache
1 compromised version
- Feb 7, 2025
Malware in bookingcom-checkout
1 compromised version
- Feb 7, 2025
Malware in bookingcom-auth
1 compromised version
- Feb 7, 2025
Malware in bookingcom-api
1 compromised version
- Feb 7, 2025
Malware in apple-tests
1 compromised version
- Feb 7, 2025
Malware in apple-user
1 compromised version
- Feb 7, 2025
Malware in apple-tools
1 compromised version
- Feb 7, 2025
Malware in bookingcom-analytics
1 compromised version
- Feb 7, 2025
Malware in apple-utils
1 compromised version
- Feb 7, 2025
Malware in bookingcom-admin
1 compromised version
- Feb 7, 2025
Malware in apple-sync
1 compromised version
- Feb 7, 2025
Malware in apple-sdk
1 compromised version
- Feb 7, 2025
Malware in apple-test
1 compromised version
- Feb 7, 2025
Malware in apple-payment
1 compromised version
- Feb 7, 2025
Malware in collapsible-group
1 compromised version
- Feb 7, 2025
Malicious code in presto-router-webui (npm)
1 compromised version
- Feb 7, 2025
Malware in presto-router-webui
1 compromised version
- Feb 7, 2025
Malicious code in my_confused_gcp_function_poc_package_v2 (npm)
- Feb 7, 2025
Malware in my_confused_gcp_function_poc_package_v2
1 compromised version
- Feb 7, 2025
Malware in casier
1 compromised version
- Feb 7, 2025
Malware in sample_cluster
1 compromised version
- Feb 7, 2025
Malware in ar2-common
1 compromised version
- Feb 7, 2025
Malicious code in zkwasm-poc (npm)
1 compromised version
- Feb 7, 2025
Malicious code in zkpay-plonky2-contract (npm)
2 compromised versions
- Feb 7, 2025
Malicious code in wasmer-term (npm)
1 compromised version
- Feb 7, 2025
Malicious code in sparo-real-repo-test (npm)
1 compromised version
- Feb 7, 2025
Malicious code in pnpm-sync-api-tests (npm)
2 compromised versions
Page 5982 of 6,647