Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Feb 3, 2025
Malicious code in cms-vue-boilerplate (npm)
3 compromised versions
- Feb 3, 2025
Malicious code in cg-be-package (npm)
3 compromised versions
- Feb 3, 2025
Malicious code in bookingcom-event (npm)
1 compromised version
- Feb 3, 2025
Malicious code in bookingcom-db (npm)
1 compromised version
- Feb 3, 2025
Malicious code in bookingcom-database (npm)
1 compromised version
- Feb 3, 2025
Malicious code in bookingcom-connect (npm)
1 compromised version
- Feb 3, 2025
Malicious code in bookingcom-admin (npm)
1 compromised version
- Feb 3, 2025
Malicious code in blynk-ide (npm)
1 compromised version
- Feb 3, 2025
Malicious code in bloomr-ts (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in bazelbuild.vscode-bazel (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in awsume (npm)
1 compromised version
- Feb 3, 2025
Malicious code in aws-genai-llm-chatbot (npm)
1 compromised version
- Feb 3, 2025
Malicious code in ar2-common (npm)
1 compromised version
- Feb 3, 2025
Malicious code in apple-utils (npm)
1 compromised version
- Feb 3, 2025
Malicious code in apple-user (npm)
1 compromised version
- Feb 3, 2025
Malicious code in apple-tools (npm)
1 compromised version
- Feb 3, 2025
Malicious code in apple-tests (npm)
1 compromised version
- Feb 3, 2025
Malicious code in apple-test (npm)
1 compromised version
- Feb 3, 2025
Malicious code in apple-sync (npm)
1 compromised version
- Feb 3, 2025
Malicious code in apple-sdk (npm)
1 compromised version
- Feb 3, 2025
Malicious code in apple-payment (npm)
1 compromised version
- Feb 3, 2025
Malicious code in @infinid-indonesia/ui-kit (npm)
1 compromised version
- Feb 3, 2025
Malicious code in zapzaperson (npm)
1 compromised version
- Feb 3, 2025
Malicious code in yandex-music-int (npm)
1 compromised version
- Feb 3, 2025
Malicious code in xapi_test (npm)
1 compromised version
- Feb 3, 2025
Malicious code in x509-escaping (npm)
4 compromised versions
- Feb 3, 2025
Malicious code in wwswqee (npm)
6 compromised versions
- Feb 3, 2025
Malicious code in wundergraph-cosmo (npm)
1 compromised version
- Feb 3, 2025
Malicious code in wt-fe-buz-utilities-url (npm)
1 compromised version
- Feb 3, 2025
Malicious code in wt-fe-buz-business-stoplimit (npm)
1 compromised version
- Feb 3, 2025
Malicious code in worqhat-tracker (npm)
3 compromised versions
- Feb 3, 2025
Malicious code in whatsapp-reader (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in web_automation_golden (npm)
1 compromised version
- Feb 3, 2025
Malicious code in vanjavzjs (npm)
1 compromised version
- Feb 3, 2025
Malicious code in ui-forms-embed-components-library (npm)
1 compromised version
- Feb 3, 2025
Malicious code in ui-forms-embed-client-api (npm)
1 compromised version
- Feb 3, 2025
Malicious code in ts-parsec-repo (npm)
1 compromised version
- Feb 3, 2025
Malicious code in timesketch (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in tesyeeyr76r74t (npm)
1 compromised version
- Feb 3, 2025
Malicious code in test-for-confirm-paths (npm)
1 compromised version
- Feb 3, 2025
Malicious code in system-remap (npm)
1 compromised version
- Feb 3, 2025
Malicious code in system-driver-scan (npm)
1 compromised version
- Feb 3, 2025
Malicious code in symlink_lib (npm)
1 compromised version
- Feb 3, 2025
Malicious code in starter-monorepo-microservices (npm)
1 compromised version
- Feb 3, 2025
Malicious code in stale-action (npm)
1 compromised version
- Feb 3, 2025
Malicious code in somewherethere (npm)
1 compromised version
- Feb 3, 2025
Malicious code in signup-ui-url-generator (npm)
1 compromised version
- Feb 3, 2025
Malicious code in security_solution (npm)
1 compromised version
- Feb 3, 2025
Malicious code in rtcstats-server (npm)
1 compromised version
- Feb 3, 2025
Malicious code in qwant-extension (npm)
1 compromised version
Page 5985 of 6,647