Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 31, 2024
Malicious code in mx-exchange-docs (npm)
1 compromised version
- Dec 31, 2024
Malicious code in bcoin-full (npm)
1 compromised version
- Dec 31, 2024
Malicious code in faucet-microservice (npm)
1 compromised version
- Dec 30, 2024
Malicious code in @swiggy-private/analytics (npm)
1 compromised version
- Dec 30, 2024
Malicious code in @swiggy-private/aatm-nirbhar-ui (npm)
1 compromised version
- Dec 30, 2024
Malicious code in @swiggy-private/aatm-nirbhar-build (npm)
1 compromised version
- Dec 30, 2024
Malicious code in @swiggy-private/aatm-nirbhar-bharat-ui (npm)
1 compromised version
- Dec 30, 2024
Withdrawn Advisory: Malware in @swiggy-private/aatm-nirbhar-build
1 compromised version
- Dec 30, 2024
Withdrawn Advisory: Malware in @swiggy-private/analytics
1 compromised version
- Dec 30, 2024
Withdrawn Advisory: Malware in @swiggy-private/aatm-nirbhar-ui
1 compromised version
- Dec 30, 2024
Withdrawn Advisory: Malware in @swiggy-private/aatm-nirbhar-bharat-ui
1 compromised version
- Dec 30, 2024
Malicious code in @swiggy-private/js-utils (npm)
40 compromised versions
- Dec 30, 2024
Malicious code in @swiggy-private/dls-web-core (npm)
5 compromised versions
- Dec 30, 2024
Withdrawn Advisory: Malware in @swiggy-private/dls-web-core
1 compromised version
- Dec 30, 2024
Withdrawn Advisory: Malware in @swiggy-private/js-utils
1 compromised version
- Dec 29, 2024
Malicious code in v2-foundry (npm)
1 compromised version
- Dec 29, 2024
Malicious code in crypto-buddies (npm)
1 compromised version
- Dec 29, 2024
Malicious code in unisocks (npm)
2 compromised versions
- Dec 27, 2024
Malicious code in proton-parking-page (npm)
1 compromised version
- Dec 27, 2024
Malicious code in plugin-sitemap-coveo (npm)
1 compromised version
- Dec 27, 2024
Malicious code in vesu_changelog (npm)
1 compromised version
- Dec 27, 2024
Malicious code in dev-journey-app (npm)
1 compromised version
- Dec 27, 2024
Malicious code in kubehook (npm)
8 compromised versions
- Dec 27, 2024
Malware in kubehook
1 compromised version
- Dec 27, 2024
Malicious code in do-not-install-this-plz (npm)
3 compromised versions
- Dec 27, 2024
Malware in do-not-install-this-plz
1 compromised version
- Dec 27, 2024
Malware in web-live-sdk
1 compromised version
- Dec 27, 2024
Malicious code in devnet-deploy (npm)
1 compromised version
- Dec 27, 2024
Malicious code in data-strategy (npm)
1 compromised version
- Dec 27, 2024
Malicious code in centers-of-excellence (npm)
1 compromised version
- Dec 27, 2024
Malware in fidentity-website
1 compromised version
- Dec 27, 2024
Malware in casino-luzern-easter-frontend
1 compromised version
- Dec 27, 2024
Malware in centers-of-excellence
1 compromised version
- Dec 27, 2024
Malware in lido-on-ethereum
1 compromised version
- Dec 27, 2024
Malware in data-strategy
1 compromised version
- Dec 27, 2024
Malware in devnet-deploy
1 compromised version
- Dec 27, 2024
Malicious code in sovryn (npm)
1 compromised version
- Dec 27, 2024
Malicious code in onyx-monorepo (npm)
2 compromised versions
- Dec 27, 2024
Malicious code in docu-scripts (npm)
1 compromised version
- Dec 27, 2024
Malicious code in comparison-interface (npm)
1 compromised version
- Dec 27, 2024
Malware in comparison-interface
1 compromised version
- Dec 27, 2024
Malware in sovryn
1 compromised version
- Dec 27, 2024
Malware in binance-toolbox-nodejs
1 compromised version
- Dec 27, 2024
Malware in docu-scripts
1 compromised version
- Dec 27, 2024
Malware in lfs-au-website-build
1 compromised version
- Dec 27, 2024
Malware in staticdocs-starter
1 compromised version
- Dec 27, 2024
Malware in load-secrets-action
1 compromised version
- Dec 27, 2024
Malware in onyx-monorepo
1 compromised version
- Dec 27, 2024
Malware in core-registry-dashboardx
1 compromised version
- Dec 27, 2024
Malware in idkit-monorepo
1 compromised version
Page 6018 of 6,647