Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 8, 2024
Malicious code in check-deps-ver-consistency (npm)
1 compromised version
- Dec 8, 2024
Malicious code in check-dependency-ver-consistency (npm)
1 compromised version
- Dec 8, 2024
Malicious code in ccs-react-lib (npm)
4 compromised versions
- Dec 8, 2024
Malicious code in ccb-app-ui-service (npm)
6 compromised versions
- Dec 8, 2024
Malicious code in cap1-modules (npm)
1 compromised version
- Dec 8, 2024
Malicious code in c1f212x412haxer (npm)
1 compromised version
- Dec 8, 2024
Malicious code in c0re-jss (npm)
1 compromised version
- Dec 8, 2024
Malicious code in byteir (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bytedance-i18n-hooks (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bytedance-i18n-ghook (npm)
1 compromised version
- Dec 8, 2024
Malicious code in byted-guides (npm)
1 compromised version
- Dec 8, 2024
Malicious code in byted-guide (npm)
1 compromised version
- Dec 8, 2024
Malicious code in byte-guides (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bloxbootstrap (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bitdefender-sitemap-creator (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in bioma (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bigcommerce-monit (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bc-loading (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bababababa (npm)
1 compromised version
- Dec 8, 2024
Malicious code in b2bneo (npm)
1 compromised version
- Dec 8, 2024
Malicious code in awf-styles (npm)
1 compromised version
- Dec 8, 2024
Malicious code in autoball (npm)
1 compromised version
- Dec 8, 2024
Malicious code in asdasssd-hello-world (npm)
1 compromised version
- Dec 8, 2024
Malicious code in asdassd-hello-world (npm)
1 compromised version
- Dec 8, 2024
Malicious code in asdasd-hello-world (npm)
1 compromised version
- Dec 8, 2024
Malicious code in asanablog (npm)
1 compromised version
- Dec 8, 2024
Malicious code in arkangel-ai (npm)
1 compromised version
- Dec 8, 2024
Malicious code in apply-brand-color (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in app-webbridge (npm)
1 compromised version
- Dec 8, 2024
Malicious code in apc-publish (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in apc-admin-utils (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in antibyfron (npm)
1 compromised version
- Dec 8, 2024
Malicious code in another-query-parser (npm)
5 compromised versions
- Dec 8, 2024
Malicious code in aiglife.episerver.web (npm)
1 compromised version
- Dec 8, 2024
Malicious code in agilent.pl29.voldemort.frontend (npm)
1 compromised version
- Dec 8, 2024
Malicious code in admin-upload-common (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in active-win1 (npm)
1 compromised version
- Dec 8, 2024
Malicious code in acribus-core (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in acp-docs (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in acces-react (npm)
1 compromised version
- Dec 8, 2024
Malicious code in ac-analytics (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in a39a85e7 (npm)
1 compromised version
- Dec 8, 2024
Malicious code in a111y-cloud (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @wf-wfmfe/sdk (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @volcenjine/tos-sdk (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @volcenjine/rtc (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @volcenjine/openapi (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @thd-eux/theme-mui (npm)
4 compromised versions
- Dec 8, 2024
Malicious code in @service-and-repairs/awpintegrationlib (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in @saleswhale/barnacle (npm)
1 compromised version
Page 6036 of 6,647