Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Nov 27, 2024
Malicious code in eslint-plugin-mkt-bff (npm)
2 compromised versions
- Nov 27, 2024
Malware in react-domain-components
1 compromised version
- Nov 27, 2024
Malware in operation-server-sdk
1 compromised version
- Nov 27, 2024
Malware in mkt-snakecase-keys
1 compromised version
- Nov 27, 2024
Malware in eslint-plugin-mkt-bff
1 compromised version
- Nov 27, 2024
Malware in linencloth
1 compromised version
- Nov 27, 2024
Malware in prettier-plugin-kimi-i18next
1 compromised version
- Nov 27, 2024
Malicious code in repository-dispatch1 (npm)
1 compromised version
- Nov 27, 2024
Malicious code in repository-dispatch (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in opendevin-frontend (npm)
- Nov 27, 2024
Malicious code in k8s-apps-wordpress (npm)
1 compromised version
- Nov 27, 2024
Malware in repository-dispatch1
1 compromised version
- Nov 27, 2024
Malware in k8s-apps-wordpress
1 compromised version
- Nov 27, 2024
Malware in opendevin-frontend
1 compromised version
- Nov 27, 2024
Malware in repository-dispatch
1 compromised version
- Nov 27, 2024
Malicious code in journey-client-reactor (npm)
- Nov 27, 2024
Malware in journey-client-reactor
1 compromised version
- Nov 27, 2024
Malicious code in spid-gc-config (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in shopee-loading-report-sdk (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in people-intv-common (npm)
2 compromised versions
- Nov 27, 2024
Malware in seller-common
1 compromised version
- Nov 27, 2024
Malware in redux-store-immutable
1 compromised version
- Nov 27, 2024
Malware in seller-vuex-report-plugin
1 compromised version
- Nov 27, 2024
Malware in spid-gc-config
1 compromised version
- Nov 27, 2024
Malware in people-intv-common
1 compromised version
- Nov 27, 2024
Malware in multi-module-plugins
1 compromised version
- Nov 27, 2024
Malware in shopee-loading-report-sdk
1 compromised version
- Nov 27, 2024
Malware in scm-retail-ui
1 compromised version
- Nov 27, 2024
Malware in item-card-config
1 compromised version
- Nov 27, 2024
Malware in viz_schema
1 compromised version
- Nov 27, 2024
Malware in marketing-base
1 compromised version
- Nov 27, 2024
Malware in storage-atom
1 compromised version
- Nov 27, 2024
Malware in eslint-plugin-wms
1 compromised version
- Nov 27, 2024
Malicious code in xstate-viz (npm)
1 compromised version
- Nov 27, 2024
Malicious code in seller-webchat-service (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in pb-ts-gen (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in mssr (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in ls-upload-cmpt (npm)
1 compromised version
- Nov 27, 2024
Malware in uuid-latest
1 compromised version
- Nov 27, 2024
Malware in xstate-viz
1 compromised version
- Nov 27, 2024
Malware in eslint-plugin-unusedvar-fix
1 compromised version
- Nov 27, 2024
Malware in pb-ts-gen
1 compromised version
- Nov 27, 2024
Malware in ssc-upload-react
1 compromised version
- Nov 27, 2024
Malware in seller-rn-mng-lib
1 compromised version
- Nov 27, 2024
Malware in spex-dts
1 compromised version
- Nov 27, 2024
Malware in rct-calculator
1 compromised version
- Nov 27, 2024
Malware in ls-upload-cmpt
1 compromised version
- Nov 27, 2024
Malware in sc-case-dispute
1 compromised version
- Nov 27, 2024
Malware in seller-base.preview
1 compromised version
- Nov 27, 2024
Malware in seller-webchat-service
1 compromised version
Page 6044 of 6,647