Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 19, 2024
Malicious code in upload-artifact (npm)
- Dec 19, 2024
Malicious code in setup-node (npm)
- Dec 19, 2024
Malicious code in go-dependency-submission (npm)
- Dec 19, 2024
Malicious code in deploy-pages (npm)
- Dec 19, 2024
Malicious code in dependency-review-action (npm)
- Dec 19, 2024
Malicious code in container-toolkit-template (npm)
- Dec 19, 2024
Malicious code in configure-pages (npm)
- Dec 19, 2024
Malicious code in actions-languageservices (npm)
- Dec 19, 2024
Malicious code in action-testtttt (npm)
- Dec 19, 2024
Malware in maven-dependency-submission-action
1 compromised version
- Dec 19, 2024
Malware in actions-languageservices
1 compromised version
- Dec 19, 2024
Malware in go-dependency-submission
1 compromised version
- Dec 19, 2024
Malware in action-testtttt
1 compromised version
- Dec 19, 2024
Malware in deploy-pages
1 compromised version
- Dec 19, 2024
Malware in container-toolkit-template
1 compromised version
- Dec 19, 2024
Malware in setup-node
1 compromised version
- Dec 19, 2024
Malware in configure-pages
1 compromised version
- Dec 19, 2024
Malware in dependency-review-action
1 compromised version
- Dec 19, 2024
Malware in upload-artifact
1 compromised version
- Dec 19, 2024
Malware in acm-nano-logger-fe
1 compromised version
- Dec 19, 2024
Malicious code in pzh (npm)
2 compromised versions
- Dec 19, 2024
Malicious code in owc-gravityforms-zaaksysteem (npm)
1 compromised version
- Dec 19, 2024
Malicious code in abacus-frontend (npm)
1 compromised version
- Dec 19, 2024
Malware in owc-gravityforms-zaaksysteem
1 compromised version
- Dec 19, 2024
Malware in pzh
1 compromised version
- Dec 19, 2024
Malware in abacus-frontend
1 compromised version
- Dec 19, 2024
Malicious code in pornhub (npm)
1 compromised version
- Dec 19, 2024
Malicious code in redux-form-v5 (npm)
1 compromised version
- Dec 19, 2024
Malicious code in yandex-pandora-docs (npm)
2 compromised versions
- Dec 18, 2024
Malicious code in auto-assign-team-actionn (npm)
5 compromised versions
- Dec 18, 2024
Malicious code in @goldenfront/core (npm)
1 compromised version
- Dec 18, 2024
Malicious code in bitmex-node-fetch (npm)
1 compromised version
- Dec 18, 2024
Malicious code in ifood2-github-io (npm)
1 compromised version
- Dec 18, 2024
Malicious code in interview-question (npm)
1 compromised version
- Dec 18, 2024
Malicious code in flybook-table (npm)
1 compromised version
- Dec 18, 2024
Malicious code in @hisdk/mail-mac (npm)
1 compromised version
- Dec 18, 2024
Malicious code in @hi.editor/core (npm)
1 compromised version
- Dec 18, 2024
Malicious code in @dz-lib/icon (npm)
1 compromised version
- Dec 18, 2024
Malicious code in @dz-lib/dz-cli (npm)
1 compromised version
- Dec 18, 2024
Malicious code in hardhat-deploy-others (npm)
1 compromised version
- Dec 18, 2024
Malicious code in focal-examples (npm)
3 compromised versions
- Dec 18, 2024
Malicious code in orderly.network (npm)
1 compromised version
- Dec 18, 2024
Malicious code in baby-loris (npm)
2 compromised versions
- Dec 18, 2024
Malicious code in bs-auto-dark-mode (npm)
3 compromised versions
- Dec 18, 2024
Malicious code in @bh-ui/theme (npm)
1 compromised version
- Dec 17, 2024
Malicious code in anargha-manu2324 (npm)
2 compromised versions
- Dec 17, 2024
Malicious code in onchain-commerce-template (npm)
1 compromised version
- Dec 17, 2024
Malicious code in yir-image-gen (npm)
2 compromised versions
- Dec 17, 2024
Malicious code in pai-web-components (npm)
1 compromised version
- Dec 17, 2024
Malicious code in @poclabs/exo-phanto (npm)
1 compromised version
Page 6027 of 6,647