Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 8, 2024
Malicious code in @rambler-help/shared (npm)
30 compromised versions
- Dec 8, 2024
Malicious code in @platform-ui-kit/components-library-react (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @mysas/shared (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @marfeel/eslint-config-js (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @linx-ui/payatu (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @leseo/book-viewer (npm)
6 compromised versions
- Dec 8, 2024
Malicious code in @isfe-common/image-minimizer (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @im-dims/baileys (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @iherb-react-environment/config (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @iherb-payment/pages (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in @facetca/facet-ruler (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @facetca/calculator (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @douinfe/semi-animation-react (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @douinfe/semi-adimation (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @douinfe/create-semi-d2c-plugin (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in @conundra/components-frontend (npm)
3 compromised versions
- Dec 8, 2024
Malicious code in @cdh-data-portal-theme/build (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in @cawraytestorg/packagetest (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @bytedanc/mona-max (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @bytedanc/mona-client-web (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @bytedanc-ad/market-ui-vue2 (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @aws-sdk-examples/libs (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in @arkangel-ai/arkangel-ai (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @agilent/web-icons (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @agilent/awf-wc (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @agilent/awf-styles (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @afound/common (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in fake-emitter-no-schema (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in chronos-web-ui (npm)
1 compromised version
- Dec 8, 2024
Malicious code in tripadvisor-npm (npm)
3 compromised versions
- Dec 8, 2024
Malicious code in nextcloud123 (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in nextcloud2 (npm)
1 compromised version
- Dec 8, 2024
Malicious code in yelp-lib (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @chia-networrk/api (npm)
6 compromised versions
- Dec 8, 2024
Malicious code in bbbx (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bbb-logging (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in less-rhino (npm)
1 compromised version
- Dec 8, 2024
Malicious code in jquery.slideviewer (npm)
1 compromised version
- Dec 8, 2024
Malicious code in auto-plugin-appetize-cleanup (npm)
1 compromised version
- Dec 8, 2024
Malicious code in appetize-cli (npm)
1 compromised version
- Dec 7, 2024
Malicious code in adminconsole (npm)
1 compromised version
- Dec 7, 2024
Malicious code in yelp-logging (npm)
2 compromised versions
- Dec 7, 2024
Malicious code in zkonmina (npm)
3 compromised versions
- Dec 7, 2024
Malicious code in react-pillbox (npm)
1 compromised version
- Dec 7, 2024
Malicious code in testing-bounty123 (npm)
1 compromised version
- Dec 7, 2024
Malicious code in calendervue (npm)
1 compromised version
- Dec 7, 2024
Malicious code in qwilr-examples-create-page (npm)
1 compromised version
- Dec 7, 2024
Malicious code in editor-devel (npm)
1 compromised version
- Dec 7, 2024
Malicious code in remix-kl-c646 (npm)
1 compromised version
- Dec 7, 2024
Malicious code in normal-dep (npm)
1 compromised version
Page 6037 of 6,647