Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,299 total in npm · sorted newest first- Nov 25, 2024
Malicious code in solarafix (npm)
5 compromised versions
- Nov 25, 2024
Malicious code in rootkitfix (npm)
1 compromised version
- Nov 25, 2024
Malware in rootkitfix
1 compromised version
- Nov 25, 2024
Malware in solarafix
1 compromised version
- Nov 25, 2024
Malicious code in clarity-lsp (npm)
1 compromised version
- Nov 24, 2024
Malicious code in clarity-vs-code-web-client (npm)
1 compromised version
- Nov 24, 2024
Malicious code in lunar-root (npm)
1 compromised version
- Nov 24, 2024
Malicious code in generate-release-description (npm)
1 compromised version
- Nov 24, 2024
Malicious code in d1-northwind (npm)
1 compromised version
- Nov 24, 2024
Malicious code in veworld-mock (npm)
1 compromised version
- Nov 24, 2024
Malicious code in eth-based-p2p-e2e-latency (npm)
1 compromised version
- Nov 24, 2024
Malicious code in canvaskit-local (npm)
1 compromised version
- Nov 24, 2024
Malicious code in quorumnetworktester (npm)
1 compromised version
- Nov 24, 2024
Malicious code in nylas-private-fonts (npm)
1 compromised version
- Nov 24, 2024
Malicious code in nylas-private-sounds (npm)
1 compromised version
- Nov 24, 2024
Malicious code in jigasi-haproxy-agent (npm)
1 compromised version
- Nov 24, 2024
Malicious code in plaid-tiny-quickstart (npm)
1 compromised version
- Nov 24, 2024
Malicious code in dashlane-vscode (npm)
1 compromised version
- Nov 23, 2024
Malicious code in certain-common-library (npm)
1 compromised version
- Nov 23, 2024
Malicious code in kiosk-cli (npm)
1 compromised version
- Nov 23, 2024
Malicious code in hackbron (npm)
1 compromised version
- Nov 23, 2024
Malicious code in graph-studio-billing-contracts (npm)
1 compromised version
- Nov 23, 2024
Malicious code in @framgia/test (npm)
2 compromised versions
- Nov 23, 2024
Malicious code in codeql-extractor-iac-action (npm)
1 compromised version
- Nov 23, 2024
Malicious code in ens-app-v2 (npm)
1 compromised version
- Nov 22, 2024
Malicious code in codeql-sarif-security-standard-annotator (npm)
1 compromised version
- Nov 22, 2024
Malicious code in security-alert-watcher (npm)
1 compromised version
- Nov 22, 2024
Malicious code in maven-dependency-submission-action (npm)
1 compromised version
- Nov 22, 2024
Malicious code in ap-components-react (npm)
2 compromised versions
- Nov 22, 2024
Malicious code in @ba-ui-toolkit/ba-graphics (npm)
4 compromised versions
- Nov 22, 2024
Malicious code in webpack-svg-spirit-import (npm)
1 compromised version
- Nov 22, 2024
Malicious code in webpack-support-multi-domain-plugin (npm)
1 compromised version
- Nov 22, 2024
Malicious code in webpack-insert-sentry-plugin (npm)
1 compromised version
- Nov 22, 2024
Malicious code in web_enhance_sap-latest (npm)
1 compromised version
- Nov 22, 2024
Malicious code in web-chat-portal (npm)
1 compromised version
- Nov 21, 2024
Malicious code in viz_schema (npm)
1 compromised version
- Nov 21, 2024
Malicious code in vite-plugin-unus-api-register (npm)
1 compromised version
- Nov 21, 2024
Malicious code in viewercontext (npm)
1 compromised version
- Nov 21, 2024
Malicious code in uuid-latest (npm)
1 compromised version
- Nov 21, 2024
Malicious code in uss-vod-js-sdk (npm)
1 compromised version
- Nov 21, 2024
Malicious code in upload-to-shopee-cdn (npm)
1 compromised version
- Nov 21, 2024
Malicious code in ts-diagnosis (npm)
1 compromised version
- Nov 21, 2024
Malicious code in my-wallet-backupt-decryption-tool (npm)
1 compromised version
- Nov 21, 2024
Malicious code in storage-atom (npm)
1 compromised version
- Nov 20, 2024
Malicious code in ssc-upload-react (npm)
1 compromised version
- Nov 20, 2024
Malicious code in ssc-ui-react-next (npm)
1 compromised version
- Nov 20, 2024
Malicious code in ssc-ui-react (npm)
1 compromised version
- Nov 20, 2024
Malicious code in ssc-org-vue (npm)
1 compromised version
- Nov 20, 2024
Malicious code in spid-sharing-panel (npm)
1 compromised version
- Nov 20, 2024
Malicious code in spid-gc-ui-leaderboard (npm)
1 compromised version
Page 6053 of 6,646