Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 19, 2024
Malware in mockapie
1 compromised version
- Dec 19, 2024
Malware in nerd4node
1 compromised version
- Dec 19, 2024
Malware in demo-resources
1 compromised version
- Dec 19, 2024
Malicious code in csp-react (npm)
4 compromised versions
- Dec 19, 2024
Malware in csp-react
1 compromised version
- Dec 19, 2024
Malicious code in uflexreward-utils (npm)
1 compromised version
- Dec 19, 2024
Malicious code in uflexreward-test (npm)
1 compromised version
- Dec 19, 2024
Malicious code in uflexreward-core (npm)
1 compromised version
- Dec 19, 2024
Malicious code in uflexreward-api (npm)
1 compromised version
- Dec 19, 2024
Malicious code in uflexreward (npm)
1 compromised version
- Dec 19, 2024
Malicious code in confidential-package-nam (npm)
1 compromised version
- Dec 19, 2024
Malware in uflexreward-test
1 compromised version
- Dec 19, 2024
Malware in uflexreward-core
1 compromised version
- Dec 19, 2024
Malware in uflexreward-utils
1 compromised version
- Dec 19, 2024
Malware in uflexreward
1 compromised version
- Dec 19, 2024
Malware in uflexreward-api
1 compromised version
- Dec 19, 2024
Malware in confidential-package-nam
1 compromised version
- Dec 19, 2024
Malicious code in quintoandar-logger (npm)
1 compromised version
- Dec 19, 2024
Malware in com.bovinelabs.analyzers
1 compromised version
- Dec 19, 2024
Malware in ripple-blobvault
1 compromised version
- Dec 19, 2024
Malware in quintoandar-logger
1 compromised version
- Dec 19, 2024
Malware in quintoandar-jwt
1 compromised version
- Dec 19, 2024
Malware in coldbox
1 compromised version
- Dec 19, 2024
Malicious code in secret-scanning-custom-notifications (npm)
- Dec 19, 2024
Malicious code in github-webhook-ip-validator (npm)
- Dec 19, 2024
Malicious code in component-detection-action (npm)
- Dec 19, 2024
Malware in codeql-sarif-security-standard-annotator
1 compromised version
- Dec 19, 2024
Malware in kiosk-cli
1 compromised version
- Dec 19, 2024
Malware in graph-studio-billing-contracts
1 compromised version
- Dec 19, 2024
Malware in github-webhook-ip-validator
1 compromised version
- Dec 19, 2024
Malware in secret-scanning-custom-notifications
1 compromised version
- Dec 19, 2024
Malware in component-detection-action
1 compromised version
- Dec 19, 2024
Malware in codeql-extractor-iac-action
1 compromised version
- Dec 19, 2024
Malware in ens-app-v2
1 compromised version
- Dec 19, 2024
Malicious code in mryayaa (npm)
- Dec 19, 2024
Malware in security-alert-watcher
1 compromised version
- Dec 19, 2024
Malware in mryayaa
1 compromised version
- Dec 19, 2024
Malicious code in self-qualification-dialog-sdk (npm)
1 compromised version
- Dec 19, 2024
Malicious code in byted-example (npm)
1 compromised version
- Dec 19, 2024
Malware in byted-example
1 compromised version
- Dec 19, 2024
Malware in self-qualification-dialog-sdk
1 compromised version
- Dec 19, 2024
Malicious code in tools_platform (npm)
1 compromised version
- Dec 19, 2024
Malicious code in tiktok-ui (npm)
1 compromised version
- Dec 19, 2024
Malicious code in df-npm-placeholder (npm)
2 compromised versions
- Dec 19, 2024
Malicious code in client-mpa (npm)
1 compromised version
- Dec 19, 2024
Malicious code in client-data (npm)
1 compromised version
- Dec 19, 2024
Malicious code in client-consent (npm)
1 compromised version
- Dec 19, 2024
Malicious code in client-cloud-phone (npm)
1 compromised version
- Dec 19, 2024
Malicious code in client-analysis (npm)
1 compromised version
- Dec 19, 2024
Malicious code in client-admin (npm)
1 compromised version
Page 6025 of 6,647