Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 19, 2024
Malware in tiktok_embed_v2
1 compromised version
- Dec 19, 2024
Malicious code in ssk (npm)
- Dec 19, 2024
Malware in ssk
1 compromised version
- Dec 19, 2024
Malicious code in zap_contracts (npm)
1 compromised version
- Dec 19, 2024
Malware in playwright-1.46
1 compromised version
- Dec 19, 2024
Malware in spinal-env-viewer-plugin-group-manager-service
1 compromised version
- Dec 19, 2024
Malware in zap_contracts
1 compromised version
- Dec 19, 2024
Malicious code in yapi-to-dts (npm)
1 compromised version
- Dec 19, 2024
Malicious code in spid-csvautofilljs (npm)
2 compromised versions
- Dec 19, 2024
Malware in vite-plugin-unus-api-register
1 compromised version
- Dec 19, 2024
Malware in yapi-to-dts
1 compromised version
- Dec 19, 2024
Malware in sso-map
1 compromised version
- Dec 19, 2024
Malware in spid-csvautofilljs
1 compromised version
- Dec 19, 2024
Malware in shopee-form-ui
1 compromised version
- Dec 19, 2024
Malicious code in zarf-ui (npm)
- Dec 19, 2024
Malicious code in serum-dex-ui (npm)
- Dec 19, 2024
Malicious code in apache-airflow-ui (npm)
2 compromised versions
- Dec 19, 2024
Malware in zarf-ui
1 compromised version
- Dec 19, 2024
Malware in apache-airflow-ui
1 compromised version
- Dec 19, 2024
Malware in serum-dex-ui
1 compromised version
- Dec 19, 2024
Malicious code in scalavex (npm)
1 compromised version
- Dec 19, 2024
Malware in scalavex
1 compromised version
- Dec 19, 2024
Malicious code in rodas (npm)
- Dec 19, 2024
Malware in rodas
1 compromised version
- Dec 19, 2024
Malicious code in react-multer (npm)
- Dec 19, 2024
Malware in react-multer
1 compromised version
- Dec 19, 2024
Malicious code in uiqweyruhen (npm)
- Dec 19, 2024
Malicious code in uieyruhen (npm)
- Dec 19, 2024
Malicious code in rdjjfjooirpp.js (npm)
1 compromised version
- Dec 19, 2024
Malware in uieyruhen
1 compromised version
- Dec 19, 2024
Malware in uiqweyruhen
1 compromised version
- Dec 19, 2024
Malware in rdjjfjooirpp.js
1 compromised version
- Dec 19, 2024
Malware in rc-network
1 compromised version
- Dec 19, 2024
Malware in raptor-library
1 compromised version
- Dec 19, 2024
Malicious code in rafarafa_package (npm)
- Dec 19, 2024
Malware in rafarafa_package
1 compromised version
- Dec 19, 2024
Malicious code in pushservicejs (npm)
- Dec 19, 2024
Malware in pushservicejs
1 compromised version
- Dec 19, 2024
Malicious code in private-bug-bounty-secret (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in private-bug-bounty (npm)
1 compromised version
- Dec 19, 2024
Malicious code in cokie-secret (npm)
1 compromised version
- Dec 19, 2024
Malware in cokie-secret
1 compromised version
- Dec 19, 2024
Malware in private-bug-bounty-secret
1 compromised version
- Dec 19, 2024
Malware in private-bug-bounty
1 compromised version
- Dec 19, 2024
Malware in web-app-search
1 compromised version
- Dec 19, 2024
Malware in prettier-v3-for-testing
1 compromised version
- Dec 19, 2024
Malicious code in ppw (npm)
- Dec 19, 2024
Malware in ppw
1 compromised version
- Dec 19, 2024
Malicious code in pnpm-run (npm)
- Dec 19, 2024
Malware in pnpm-run
1 compromised version
Page 6021 of 6,647