Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 19, 2024
Malware in eslint-config-sunset-nodejs
1 compromised version
- Dec 19, 2024
Malware in otc-echo
1 compromised version
- Dec 19, 2024
Malware in tauri-plugin-autostart-api
1 compromised version
- Dec 19, 2024
Malicious code in eslint-config-extraterm (npm)
1 compromised version
- Dec 19, 2024
Malware in eslint-config-extraterm
1 compromised version
- Dec 19, 2024
Malware in qt-construct
1 compromised version
- Dec 19, 2024
Malware in tailchat-service-swagger-generator
1 compromised version
- Dec 19, 2024
Malware in com.unity.collections
1 compromised version
- Dec 19, 2024
Malicious code in eritiopitop (npm)
1 compromised version
- Dec 19, 2024
Malware in eritiopitop
1 compromised version
- Dec 19, 2024
Malicious code in ecpfs-react-build-scripts (npm)
1 compromised version
- Dec 19, 2024
Malware in ecpfs-react-build-scripts
1 compromised version
- Dec 19, 2024
Malicious code in ecpfs-react-data-driven-components (npm)
1 compromised version
- Dec 19, 2024
Malicious code in ecpfs-authority (npm)
3 compromised versions
- Dec 19, 2024
Malware in ecpfs-authority
1 compromised version
- Dec 19, 2024
Malware in ecpfs-react-data-driven-components
1 compromised version
- Dec 19, 2024
Malicious code in yb-animations (npm)
1 compromised version
- Dec 19, 2024
Malicious code in manajemenservice (npm)
- Dec 19, 2024
Malicious code in eb-docs (npm)
3 compromised versions
- Dec 19, 2024
Malware in manajemenservice
1 compromised version
- Dec 19, 2024
Malware in eb-docs
1 compromised version
- Dec 19, 2024
Malware in yb-animations
1 compromised version
- Dec 19, 2024
Malicious code in easytint (npm)
4 compromised versions
- Dec 19, 2024
Malware in easytint
1 compromised version
- Dec 19, 2024
Malicious code in woodpecker-ci (npm)
1 compromised version
- Dec 19, 2024
Malicious code in my-app-name (npm)
1 compromised version
- Dec 19, 2024
Malicious code in docusaurus-extensions (npm)
2 compromised versions
- Dec 19, 2024
Malware in docusaurus-extensions
1 compromised version
- Dec 19, 2024
Malware in woodpecker-ci
1 compromised version
- Dec 19, 2024
Malware in my-app-name
1 compromised version
- Dec 19, 2024
Malicious code in xrp_set_dest_tag (npm)
2 compromised versions
- Dec 19, 2024
Malicious code in tournament_service (npm)
9 compromised versions
- Dec 19, 2024
Malicious code in slack-sns (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in nimiq-rewards-calculator (npm)
1 compromised version
- Dec 19, 2024
Malicious code in github-account-switcher (npm)
1 compromised version
- Dec 19, 2024
Malware in detection-rules-explorer
1 compromised version
- Dec 19, 2024
Malware in bitmex-node-fetch
1 compromised version
- Dec 19, 2024
Malware in xrp_set_dest_tag
1 compromised version
- Dec 19, 2024
Malware in tournament_service
1 compromised version
- Dec 19, 2024
Malware in nimiq-rewards-calculator
1 compromised version
- Dec 19, 2024
Malware in react-pillbox
1 compromised version
- Dec 19, 2024
Malware in slack-sns
1 compromised version
- Dec 19, 2024
Malware in github-account-switcher
1 compromised version
- Dec 19, 2024
Malicious code in dep-confusion-tester (npm)
- Dec 19, 2024
Malware in dep-confusion-tester
1 compromised version
- Dec 19, 2024
Malicious code in nerd4node (npm)
1 compromised version
- Dec 19, 2024
Malicious code in mockapie (npm)
1 compromised version
- Dec 19, 2024
Malicious code in azure-sdk-for-java-codegen (npm)
- Dec 19, 2024
Malware in tailchat-service-openapi-generator
1 compromised version
- Dec 19, 2024
Malware in azure-sdk-for-java-codegen
1 compromised version
Page 6024 of 6,647