Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Nov 27, 2024
Malware in mssr
1 compromised version
- Nov 27, 2024
Malware in iconscout-unicons-tarball
1 compromised version
- Nov 27, 2024
Malicious code in uatu-lib (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in ssc-ui-static (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in soybean-admin-layout (npm)
- Nov 27, 2024
Malicious code in shopee-guide (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in rollup-plugin-hotreload (npm)
26 compromised versions
- Nov 27, 2024
Malicious code in react-is-17 (npm)
1 compromised version
- Nov 27, 2024
Malicious code in pap-sdk (npm)
6 compromised versions
- Nov 27, 2024
Malicious code in listing-reporter (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in bll-cerberus (npm)
2 compromised versions
- Nov 27, 2024
Malware in pvct-cli
1 compromised version
- Nov 27, 2024
Malware in soybean-admin-layout
1 compromised version
- Nov 27, 2024
Malware in eslint-plugin-shopee
1 compromised version
- Nov 27, 2024
Malware in mangadex-archive-torrent-processor
1 compromised version
- Nov 27, 2024
Malware in ssc-ui-static
1 compromised version
- Nov 27, 2024
Malware in shopee-guide
1 compromised version
- Nov 27, 2024
Malware in react-is-17
1 compromised version
- Nov 27, 2024
Malware in webpack-svg-spirit-import
1 compromised version
- Nov 27, 2024
Malware in bll-cerberus
1 compromised version
- Nov 27, 2024
Malware in seller-base
1 compromised version
- Nov 27, 2024
Malware in rollup-plugin-hotreload
1 compromised version
- Nov 27, 2024
Malware in uatu-lib
1 compromised version
- Nov 27, 2024
Malware in pap-sdk
1 compromised version
- Nov 27, 2024
Malware in listing-reporter
1 compromised version
- Nov 27, 2024
Malware in http-long-poll-client
1 compromised version
- Nov 27, 2024
Malware in seller-payment-service
1 compromised version
- Nov 27, 2024
Malicious code in tsp-rn-sdk (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in simplified-jsbridge (npm)
1 compromised version
- Nov 27, 2024
Malicious code in seller-payment-common (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in protobufjs-shopee (npm)
2 compromised versions
- Nov 27, 2024
Malware in eslint-plugin-module-dependencies
1 compromised version
- Nov 27, 2024
Malware in rollup-plugin-amd-output-enhance
1 compromised version
- Nov 27, 2024
Malware in protobufjs-shopee
1 compromised version
- Nov 27, 2024
Malware in webpack-support-multi-domain-plugin
1 compromised version
- Nov 27, 2024
Malware in filter-engine-ui
1 compromised version
- Nov 27, 2024
Malware in react-is-16
1 compromised version
- Nov 27, 2024
Malware in tsp-rn-sdk
1 compromised version
- Nov 27, 2024
Malware in mkt-worker-loader
1 compromised version
- Nov 27, 2024
Malware in seller-assistance-service
1 compromised version
- Nov 27, 2024
Malware in ssc-ui-react-next
1 compromised version
- Nov 27, 2024
Malware in grpclb-zk
1 compromised version
- Nov 27, 2024
Malware in simplified-jsbridge
1 compromised version
- Nov 27, 2024
Malware in pap-rn-sdk
1 compromised version
- Nov 27, 2024
Malware in listing-devtools
1 compromised version
- Nov 27, 2024
Malware in seller-payment-common
1 compromised version
- Nov 27, 2024
Malware in bdc-materials
1 compromised version
- Nov 27, 2024
Malicious code in transify-helper-cli (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in shop-market-uss (npm)
1 compromised version
- Nov 27, 2024
Malware in seller-admin-common
1 compromised version
Page 6045 of 6,647