Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 19, 2024
Malware in uid2-publisher
1 compromised version
- Dec 19, 2024
Malicious code in hyperion-react-testapp (npm)
1 compromised version
- Dec 19, 2024
Malware in hyperion-react-testapp
1 compromised version
- Dec 19, 2024
Malicious code in blz-internal-pkg_update (npm)
5 compromised versions
- Dec 19, 2024
Malicious code in host-exploit (npm)
- Dec 19, 2024
Malware in host-exploit
1 compromised version
- Dec 19, 2024
Malicious code in healenium (npm)
4 compromised versions
- Dec 19, 2024
Malware in healenium
1 compromised version
- Dec 19, 2024
Malicious code in spinal-env-viewer-plugin-documentation-service (npm)
1 compromised version
- Dec 19, 2024
Malware in vue-midata
1 compromised version
- Dec 19, 2024
Malware in h5bp-docs
1 compromised version
- Dec 19, 2024
Malware in playwright-1.45
1 compromised version
- Dec 19, 2024
Malware in spinal-env-viewer-plugin-documentation-service
1 compromised version
- Dec 19, 2024
Malicious code in vintage-poc (npm)
1 compromised version
- Dec 19, 2024
Malicious code in grid-context (npm)
1 compromised version
- Dec 19, 2024
Malware in grid-context
1 compromised version
- Dec 19, 2024
Malware in vintage-poc
1 compromised version
- Dec 19, 2024
Malicious code in gft-view-helpers (npm)
- Dec 19, 2024
Malicious code in gft-sam-connector (npm)
- Dec 19, 2024
Malicious code in gft-model-utils (npm)
- Dec 19, 2024
Malware in gft-view-helpers
1 compromised version
- Dec 19, 2024
Malware in gft-sam-connector
1 compromised version
- Dec 19, 2024
Malware in gft-model-utils
1 compromised version
- Dec 19, 2024
Malicious code in gatsby-plugin-guru-export (npm)
2 compromised versions
- Dec 19, 2024
Malware in gatsby-plugin-guru-export
1 compromised version
- Dec 19, 2024
Malicious code in template-fullstack (npm)
1 compromised version
- Dec 19, 2024
Malware in template-fullstack
1 compromised version
- Dec 19, 2024
Malware in spinal-env-viewer-graph-service
1 compromised version
- Dec 19, 2024
Malware in fluid-tooltip
1 compromised version
- Dec 19, 2024
Malware in spinal-core-connectorjs_type
1 compromised version
- Dec 19, 2024
Malware in dhp-logging-lib
1 compromised version
- Dec 19, 2024
Malicious code in reftest-helper-for-ae1x (npm)
1 compromised version
- Dec 19, 2024
Malicious code in fluid-renderer (npm)
1 compromised version
- Dec 19, 2024
Malware in reftest-helper-for-ae1x
1 compromised version
- Dec 19, 2024
Malware in fluid-renderer
1 compromised version
- Dec 19, 2024
Malicious code in gps-gateway-client (npm)
- Dec 19, 2024
Malware in gps-gateway-client
1 compromised version
- Dec 19, 2024
Malware in flpweb
1 compromised version
- Dec 19, 2024
Malicious code in reftest-helper (npm)
1 compromised version
- Dec 19, 2024
Malicious code in firebase-simple-login (npm)
1 compromised version
- Dec 19, 2024
Malicious code in dhp-http-lib (npm)
1 compromised version
- Dec 19, 2024
Malware in spinal-core-connectorjs
1 compromised version
- Dec 19, 2024
Malware in reftest-helper
1 compromised version
- Dec 19, 2024
Malware in dhp-http-lib
1 compromised version
- Dec 19, 2024
Malware in firebase-simple-login
1 compromised version
- Dec 19, 2024
Malicious code in evil-package-for-test2 (npm)
1 compromised version
- Dec 19, 2024
Malware in evil-package-for-test2
1 compromised version
- Dec 19, 2024
Malicious code in otc-echo (npm)
1 compromised version
- Dec 19, 2024
Malware in readium-css
1 compromised version
- Dec 19, 2024
Malware in com.unity.entities
1 compromised version
Page 6023 of 6,647