Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 22, 2024
Malicious code in lib-wallet-store (npm)
1 compromised version
- Dec 22, 2024
Malicious code in id-assert-authz-grant-client (npm)
1 compromised version
- Dec 22, 2024
Malicious code in conversations-embed (npm)
2 compromised versions
- Dec 22, 2024
Malicious code in ui-forms-embed-components-reporting (npm)
1 compromised version
- Dec 22, 2024
Malicious code in parliament-ui-components (npm)
1 compromised version
- Dec 21, 2024
Malicious code in app-settings-template (npm)
1 compromised version
- Dec 21, 2024
Malicious code in goji-js-org (npm)
2 compromised versions
- Dec 21, 2024
Malicious code in react-native-simpl (npm)
1 compromised version
- Dec 21, 2024
Malicious code in cosmos-hub-docs-site (npm)
1 compromised version
- Dec 21, 2024
Malicious code in owncloud-customgroups-dev (npm)
1 compromised version
- Dec 21, 2024
Malicious code in dynamodb-data-mapper-js (npm)
1 compromised version
- Dec 21, 2024
Malicious code in mono-faucet (npm)
1 compromised version
- Dec 21, 2024
Malicious code in @shahwarhello/l2geth (npm)
1 compromised version
- Dec 21, 2024
Malicious code in lerna-monorepo2 (npm)
1 compromised version
- Dec 20, 2024
Malicious code in testbyakash2310xxxxxxxnowaympasti (npm)
1 compromised version
- Dec 20, 2024
Malicious code in testbyakash2310please (npm)
1 compromised version
- Dec 20, 2024
Malicious code in security-admin (npm)
1 compromised version
- Dec 20, 2024
Malicious code in phonepe-payment-capacitor (npm)
1 compromised version
- Dec 20, 2024
Malicious code in kubernetes-jobs-javascript (npm)
1 compromised version
- Dec 20, 2024
Malicious code in layerzero-v2 (npm)
1 compromised version
- Dec 20, 2024
Malicious code in api-demo-sample-lib1 (npm)
1 compromised version
- Dec 20, 2024
Malicious code in grafana-report-panel (npm)
1 compromised version
- Dec 20, 2024
Malicious code in @rrvis/code-mapper (npm)
3 compromised versions
- Dec 20, 2024
Malicious code in @rrvis/dialog (npm)
3 compromised versions
- Dec 20, 2024
Malicious code in shahwar-demo (npm)
1 compromised version
- Dec 20, 2024
Malicious code in 4m-clean-shopify-app (npm)
4 compromised versions
- Dec 20, 2024
Malicious code in mindmeld-ui (npm)
1 compromised version
- Dec 20, 2024
Malicious code in yb2bacceleratorstorefront-web (npm)
1 compromised version
- Dec 20, 2024
Malicious code in squirreldisk-tauri (npm)
2 compromised versions
- Dec 20, 2024
Malicious code in nuget.shouldly (npm)
2 compromised versions
- Dec 20, 2024
Malicious code in aauto-assign-team-action (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in @rrvis/ui (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in @rrvis/util (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in @rrvis/epaas (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in @rrvis/vehicle (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in @rrvis/logger (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in tracking-protection-experiment (npm)
1 compromised version
- Dec 19, 2024
Malicious code in com.unity.assetgraph (npm)
1 compromised version
- Dec 19, 2024
Malicious code in @metrics-service/mf-client (npm)
1 compromised version
- Dec 19, 2024
Malware in @metrics-service/mf-client
1 compromised version
- Dec 19, 2024
Malicious code in editions-dev-workshop (npm)
1 compromised version
- Dec 19, 2024
Malicious code in @add-wallet-exchange/type-api-data (npm)
- Dec 19, 2024
Malicious code in @add-wallet-exchange/set-imported-csv-message (npm)
- Dec 19, 2024
Malicious code in @add-wallet-exchange/reset (npm)
- Dec 19, 2024
Malicious code in @add-wallet-exchange/import-type (npm)
- Dec 19, 2024
Malware in @add-wallet-exchange/type-api-data
1 compromised version
- Dec 19, 2024
Malware in @add-wallet-exchange/import-type
1 compromised version
- Dec 19, 2024
Malware in @add-wallet-exchange/set-imported-csv-message
1 compromised version
- Dec 19, 2024
Malware in @add-wallet-exchange/reset
1 compromised version
- Dec 19, 2024
Malicious code in tiktok_embed_v2 (npm)
3 compromised versions
Page 6020 of 6,647