Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 10, 2024
Malicious code in keycloak-server (npm)
3 compromised versions
- Dec 10, 2024
Malicious code in keypair-layout-utils (npm)
- Dec 10, 2024
Malware in keypair-layout-utils
1 compromised version
- Dec 10, 2024
Malicious code in idkit-monorepo (npm)
1 compromised version
- Dec 10, 2024
Malicious code in lfs-au-website-build (npm)
1 compromised version
- Dec 10, 2024
Malicious code in core-registry-dashboardx (npm)
1 compromised version
- Dec 10, 2024
Malicious code in staticdocs-starter (npm)
1 compromised version
- Dec 10, 2024
Malicious code in binance-toolbox-nodejs (npm)
1 compromised version
- Dec 9, 2024
Malicious code in @wf-ceo/react-test-helpers (npm)
3 compromised versions
- Dec 9, 2024
Malicious code in jekyll-doxy (npm)
1 compromised version
- Dec 9, 2024
Malicious code in tokenize-lib (npm)
1 compromised version
- Dec 9, 2024
Malicious code in passport-openpass-example (npm)
1 compromised version
- Dec 9, 2024
Malicious code in @wf-ceo/utilities (npm)
3 compromised versions
- Dec 9, 2024
Malicious code in @neo-ds/neo-utils (npm)
1 compromised version
- Dec 9, 2024
Malicious code in promisified-resource-pool123 (npm)
2 compromised versions
- Dec 9, 2024
Malicious code in web-live-sdk (npm)
3 compromised versions
- Dec 9, 2024
Malicious code in dhp-logging-lib (npm)
1 compromised version
- Dec 9, 2024
Malicious code in com.unity.entities (npm)
1 compromised version
- Dec 9, 2024
Malicious code in com.unity.collections (npm)
1 compromised version
- Dec 9, 2024
Malicious code in @neo-ds/components (npm)
1 compromised version
- Dec 9, 2024
Malicious code in playwright-1.47 (npm)
1 compromised version
- Dec 9, 2024
Malicious code in v5_2 (npm)
1 compromised version
- Dec 9, 2024
Malicious code in playwright-1.46 (npm)
1 compromised version
- Dec 9, 2024
Malicious code in xigplayer (npm)
1 compromised version
- Dec 9, 2024
Malicious code in wynn-and-encore (npm)
2 compromised versions
- Dec 9, 2024
Malicious code in wp-zuny (npm)
1 compromised version
- Dec 9, 2024
Malicious code in wordpress-components-slotfill (npm)
1 compromised version
- Dec 9, 2024
Malicious code in woocommerce-grow-jsdoc (npm)
1 compromised version
- Dec 9, 2024
Malicious code in winupdate (npm)
1 compromised version
- Dec 9, 2024
Malicious code in windowsversionupdate (npm)
1 compromised version
- Dec 9, 2024
Malicious code in windowsversioncheck (npm)
1 compromised version
- Dec 9, 2024
Malicious code in widget-session-sample (npm)
2 compromised versions
- Dec 9, 2024
Malicious code in playwright-1.45 (npm)
1 compromised version
- Dec 9, 2024
Malicious code in webpacks-dev-servers (npm)
1 compromised version
- Dec 9, 2024
Malicious code in webpacks-bundles-analyzer (npm)
1 compromised version
- Dec 9, 2024
Malicious code in webpacks-bundle-analyze (npm)
1 compromised version
- Dec 9, 2024
Malicious code in web3-austt (npm)
1 compromised version
- Dec 9, 2024
Malicious code in waveapiv2 (npm)
2 compromised versions
- Dec 9, 2024
Malicious code in vulnerabledriver (npm)
1 compromised version
- Dec 9, 2024
Malicious code in vue3-tiktok (npm)
1 compromised version
- Dec 9, 2024
Malicious code in vue2-tiktok (npm)
1 compromised version
- Dec 9, 2024
Malicious code in vue-nect (npm)
1 compromised version
- Dec 9, 2024
Malicious code in vue-cli-plugin-changelog (npm)
1 compromised version
- Dec 9, 2024
Malicious code in vscode-dotnet-runtime (npm)
1 compromised version
- Dec 9, 2024
Malicious code in velos-lp-ui (npm)
1 compromised version
- Dec 9, 2024
Malicious code in varmor (npm)
1 compromised version
- Dec 9, 2024
Malicious code in updkernels (npm)
1 compromised version
- Dec 9, 2024
Malicious code in updatescan (npm)
1 compromised version
- Dec 9, 2024
Malicious code in update-button-module (npm)
1 compromised version
- Dec 9, 2024
Malicious code in unlock-wave (npm)
1 compromised version
Page 6032 of 6,647