Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 2, 2024
Malicious code in @hmp/h-shelves (npm)
2 compromised versions
- Dec 2, 2024
Malicious code in @hmp/h-image-uploader (npm)
1 compromised version
- Dec 1, 2024
Malicious code in tauri-plugin-autostart-api (npm)
1 compromised version
- Dec 1, 2024
Malicious code in tailchat-service-swagger-generator (npm)
1 compromised version
- Dec 1, 2024
Malicious code in tailchat-service-openapi-generator (npm)
1 compromised version
- Dec 1, 2024
Malicious code in spinal-service-ticket (npm)
1 compromised version
- Dec 1, 2024
Malicious code in spinal-lib-organ-monitoring (npm)
1 compromised version
- Dec 1, 2024
Malicious code in spinal-env-viewer-plugin-group-manager-service (npm)
1 compromised version
- Dec 1, 2024
Malicious code in spinal-env-viewer-graph-service (npm)
1 compromised version
- Dec 1, 2024
Malicious code in spinal-core-connectorjs_type (npm)
1 compromised version
- Dec 1, 2024
Malicious code in spinal-core-connectorjs (npm)
1 compromised version
- Dec 1, 2024
Malicious code in readium-css (npm)
1 compromised version
- Dec 1, 2024
Malicious code in qt-construct (npm)
1 compromised version
- Dec 1, 2024
Malicious code in arcverc (npm)
1 compromised version
- Dec 1, 2024
Malicious code in @peakon/records (npm)
1 compromised version
- Dec 1, 2024
Malicious code in language-babel (npm)
1 compromised version
- Dec 1, 2024
Malicious code in h5bp-docs (npm)
1 compromised version
- Dec 1, 2024
Malicious code in fluid-tooltip (npm)
1 compromised version
- Dec 1, 2024
Malicious code in eslint-config-sunset-nodejs (npm)
1 compromised version
- Dec 1, 2024
Malicious code in demo-resources (npm)
1 compromised version
- Nov 30, 2024
Malicious code in fetlla2-js (npm)
5 compromised versions
- Nov 30, 2024
Malicious code in o-tabssssssle (npm)
2 compromised versions
- Nov 30, 2024
Malicious code in flpweb (npm)
1 compromised version
- Nov 29, 2024
Malicious code in o-table (npm)
3 compromised versions
- Nov 29, 2024
Malicious code in flutter-angular-bridge (npm)
- Nov 29, 2024
Malicious code in communication-bridge (npm)
- Nov 29, 2024
Malware in communication-bridge
1 compromised version
- Nov 29, 2024
Malware in flutter-angular-bridge
1 compromised version
- Nov 29, 2024
Malicious code in safeness-sb (npm)
4 compromised versions
- Nov 29, 2024
Malicious code in safeness-backup (npm)
- Nov 29, 2024
Malware in safeness-backup
1 compromised version
- Nov 29, 2024
Malware in safeness-sb
1 compromised version
- Nov 29, 2024
Malicious code in all-dl-404 (npm)
- Nov 29, 2024
Malware in all-dl-404
1 compromised version
- Nov 29, 2024
Malicious code in rudije (npm)
- Nov 29, 2024
Malicious code in noirxnodemailer (npm)
1 compromised version
- Nov 29, 2024
Malicious code in enimoka (npm)
- Nov 29, 2024
Malicious code in cussionsbp (npm)
- Nov 29, 2024
Malicious code in citiycar (npm)
- Nov 29, 2024
Malware in cussionsbp
1 compromised version
- Nov 29, 2024
Malware in citiycar
1 compromised version
- Nov 29, 2024
Malware in rudije
1 compromised version
- Nov 29, 2024
Malware in enimoka
1 compromised version
- Nov 29, 2024
Malware in noirxnodemailer
1 compromised version
- Nov 29, 2024
Malware in certain-common-library
1 compromised version
- Nov 29, 2024
Malware in node-commerce-web
1 compromised version
- Nov 29, 2024
Malicious code in nayan-server (npm)
- Nov 29, 2024
Malicious code in nayan-media-downloader (npm)
- Nov 29, 2024
Malicious code in n-hub (npm)
- Nov 29, 2024
Malicious code in imgur-upload-api (npm)
Page 6040 of 6,647