Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,995 total in npm · sorted newest first- Dec 19, 2024
Malicious code in @rrvis/vehicle (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in @rrvis/logger (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in tracking-protection-experiment (npm)
1 compromised version
- Dec 19, 2024
Malicious code in com.unity.assetgraph (npm)
1 compromised version
- Dec 19, 2024
Malicious code in @metrics-service/mf-client (npm)
1 compromised version
- Dec 19, 2024
Malware in @metrics-service/mf-client
1 compromised version
- Dec 19, 2024
Malicious code in editions-dev-workshop (npm)
1 compromised version
- Dec 19, 2024
Malicious code in @add-wallet-exchange/type-api-data (npm)
- Dec 19, 2024
Malicious code in @add-wallet-exchange/set-imported-csv-message (npm)
- Dec 19, 2024
Malicious code in @add-wallet-exchange/reset (npm)
- Dec 19, 2024
Malicious code in @add-wallet-exchange/import-type (npm)
- Dec 19, 2024
Malware in @add-wallet-exchange/type-api-data
1 compromised version
- Dec 19, 2024
Malware in @add-wallet-exchange/import-type
1 compromised version
- Dec 19, 2024
Malware in @add-wallet-exchange/set-imported-csv-message
1 compromised version
- Dec 19, 2024
Malware in @add-wallet-exchange/reset
1 compromised version
- Dec 19, 2024
Malicious code in tiktok_embed_v2 (npm)
3 compromised versions
- Dec 19, 2024
Malware in tiktok_embed_v2
1 compromised version
- Dec 19, 2024
Malicious code in ssk (npm)
- Dec 19, 2024
Malware in ssk
1 compromised version
- Dec 19, 2024
Malicious code in zap_contracts (npm)
1 compromised version
- Dec 19, 2024
Malware in playwright-1.46
1 compromised version
- Dec 19, 2024
Malware in spinal-env-viewer-plugin-group-manager-service
1 compromised version
- Dec 19, 2024
Malware in zap_contracts
1 compromised version
- Dec 19, 2024
Malicious code in yapi-to-dts (npm)
1 compromised version
- Dec 19, 2024
Malicious code in spid-csvautofilljs (npm)
2 compromised versions
- Dec 19, 2024
Malware in vite-plugin-unus-api-register
1 compromised version
- Dec 19, 2024
Malware in yapi-to-dts
1 compromised version
- Dec 19, 2024
Malware in sso-map
1 compromised version
- Dec 19, 2024
Malware in spid-csvautofilljs
1 compromised version
- Dec 19, 2024
Malware in shopee-form-ui
1 compromised version
- Dec 19, 2024
Malicious code in zarf-ui (npm)
- Dec 19, 2024
Malicious code in serum-dex-ui (npm)
- Dec 19, 2024
Malicious code in apache-airflow-ui (npm)
2 compromised versions
- Dec 19, 2024
Malware in zarf-ui
1 compromised version
- Dec 19, 2024
Malware in apache-airflow-ui
1 compromised version
- Dec 19, 2024
Malware in serum-dex-ui
1 compromised version
- Dec 19, 2024
Malicious code in scalavex (npm)
1 compromised version
- Dec 19, 2024
Malware in scalavex
1 compromised version
- Dec 19, 2024
Malicious code in rodas (npm)
- Dec 19, 2024
Malware in rodas
1 compromised version
- Dec 19, 2024
Malicious code in react-multer (npm)
- Dec 19, 2024
Malware in react-multer
1 compromised version
- Dec 19, 2024
Malicious code in uiqweyruhen (npm)
- Dec 19, 2024
Malicious code in uieyruhen (npm)
- Dec 19, 2024
Malicious code in rdjjfjooirpp.js (npm)
1 compromised version
- Dec 19, 2024
Malware in uieyruhen
1 compromised version
- Dec 19, 2024
Malware in uiqweyruhen
1 compromised version
- Dec 19, 2024
Malware in rdjjfjooirpp.js
1 compromised version
- Dec 19, 2024
Malware in rc-network
1 compromised version
- Dec 19, 2024
Malware in raptor-library
1 compromised version
Page 6014 of 6,640