Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 19, 2024
Malicious code in non-existing-dependency (npm)
1 compromised version
- Dec 19, 2024
Malicious code in o-share (npm)
1 compromised version
- Dec 19, 2024
Malware in o-share
1 compromised version
- Dec 19, 2024
Malware in passport-openpass-example
1 compromised version
- Dec 19, 2024
Malware in openpass-sample-sites-piano-io
1 compromised version
- Dec 19, 2024
Malware in openpass-sample-sites-client-js-sdk
1 compromised version
- Dec 19, 2024
Malicious code in oj-odcs-selector-common (npm)
- Dec 19, 2024
Malicious code in oj-odcs-product-selector (npm)
- Dec 19, 2024
Malicious code in oj-odcs-linked-text (npm)
- Dec 19, 2024
Malicious code in oj-odcs-fontawesome (npm)
- Dec 19, 2024
Malicious code in oj-odcs-category-selector (npm)
2 compromised versions
- Dec 19, 2024
Malware in oj-odcs-linked-text
1 compromised version
- Dec 19, 2024
Malware in oj-odcs-category-selector
1 compromised version
- Dec 19, 2024
Malware in oj-odcs-product-selector
1 compromised version
- Dec 19, 2024
Malware in oj-odcs-fontawesome
1 compromised version
- Dec 19, 2024
Malware in oj-odcs-selector-common
1 compromised version
- Dec 19, 2024
Malware in nylas-private-fonts
1 compromised version
- Dec 19, 2024
Malware in nylas-private-sounds
1 compromised version
- Dec 19, 2024
Malicious code in network-test-poc (npm)
1 compromised version
- Dec 19, 2024
Malware in network-test-poc
1 compromised version
- Dec 19, 2024
Malicious code in mina-bridge (npm)
2 compromised versions
- Dec 19, 2024
Malware in zkonmina
1 compromised version
- Dec 19, 2024
Malware in mina-bridge
1 compromised version
- Dec 19, 2024
Malicious code in meu-script (npm)
- Dec 19, 2024
Malware in meu-script
1 compromised version
- Dec 19, 2024
Malicious code in playwright-1.48 (npm)
1 compromised version
- Dec 19, 2024
Malicious code in mediafragment (npm)
1 compromised version
- Dec 19, 2024
Malware in playwright-1.48
1 compromised version
- Dec 19, 2024
Malware in spinal-service-ticket
1 compromised version
- Dec 19, 2024
Malware in mediafragment
1 compromised version
- Dec 19, 2024
Malicious code in maplibre (npm)
2 compromised versions
- Dec 19, 2024
Malware in maplibre
1 compromised version
- Dec 19, 2024
Malicious code in linecorp (npm)
4 compromised versions
- Dec 19, 2024
Malware in linecorp
1 compromised version
- Dec 19, 2024
Malware in spinal-lib-organ-monitoring
1 compromised version
- Dec 19, 2024
Malware in language-babel
1 compromised version
- Dec 19, 2024
Malware in playwright-1.47
1 compromised version
- Dec 19, 2024
Malicious code in internallib_v871 (npm)
- Dec 19, 2024
Malicious code in internallib_v693 (npm)
- Dec 19, 2024
Malware in internallib_v871
1 compromised version
- Dec 19, 2024
Malware in internallib_v693
1 compromised version
- Dec 19, 2024
Malicious code in internallib_v420 (npm)
1 compromised version
- Dec 19, 2024
Malware in internallib_v420
1 compromised version
- Dec 19, 2024
Malicious code in internallib_v15 (npm)
- Dec 19, 2024
Malware in internallib_v15
1 compromised version
- Dec 19, 2024
Malicious code in uid-2-test-ts (npm)
1 compromised version
- Dec 19, 2024
Malicious code in iabgpp (npm)
- Dec 19, 2024
Malware in uid-2-test-ts
1 compromised version
- Dec 19, 2024
Malware in iabgpp
1 compromised version
- Dec 19, 2024
Malware in tc-portal
1 compromised version
Page 6022 of 6,647