Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,299 total in npm · sorted newest first- Nov 14, 2024
Malicious code in ax-ntlm (npm)
- Nov 14, 2024
Malware in ax-ntlm
1 compromised version
- Nov 14, 2024
Malicious code in htp2 (npm)
- Nov 14, 2024
Malware in htp2
1 compromised version
- Nov 14, 2024
Malicious code in p-oauth2 (npm)
- Nov 14, 2024
Malware in p-oauth2
1 compromised version
- Nov 14, 2024
Malicious code in p-http (npm)
- Nov 14, 2024
Malware in p-http
1 compromised version
- Nov 14, 2024
Malicious code in basicath (npm)
- Nov 14, 2024
Malware in basicath
1 compromised version
- Nov 14, 2024
Malicious code in htp-https (npm)
- Nov 14, 2024
Malware in htp-https
1 compromised version
- Nov 14, 2024
Malicious code in axios-cookiesupport (npm)
- Nov 14, 2024
Malware in axios-cookiesupport
1 compromised version
- Nov 14, 2024
Malicious code in agentbas (npm)
- Nov 14, 2024
Malware in agentbas
1 compromised version
- Nov 14, 2024
Malicious code in nod-proxy (npm)
- Nov 14, 2024
Malware in nod-proxy
1 compromised version
- Nov 14, 2024
Malicious code in mkt-worker-loader (npm)
1 compromised version
- Nov 14, 2024
Malicious code in mkt-snakecase-keys (npm)
1 compromised version
- Nov 14, 2024
Malicious code in mdap-cli (npm)
1 compromised version
- Nov 14, 2024
Malicious code in markservice (npm)
1 compromised version
- Nov 14, 2024
Malicious code in markomponent (npm)
1 compromised version
- Nov 14, 2024
Malicious code in marketing-jest-cli (npm)
1 compromised version
- Nov 14, 2024
Malicious code in marketing-eslint-check (npm)
1 compromised version
- Nov 14, 2024
Malicious code in marketing-base (npm)
1 compromised version
- Nov 14, 2024
Malicious code in magic-umi-request (npm)
1 compromised version
- Nov 14, 2024
Malicious code in listing-uss-sdk (npm)
1 compromised version
- Nov 13, 2024
Malicious code in listing-sc-lint (npm)
1 compromised version
- Nov 13, 2024
Malicious code in listing-devtools (npm)
1 compromised version
- Nov 13, 2024
Malicious code in lightweight-store (npm)
1 compromised version
- Nov 13, 2024
Malicious code in item-card-config (npm)
1 compromised version
- Nov 13, 2024
Malicious code in iconscout-unicons-tarball (npm)
1 compromised version
- Nov 13, 2024
Malicious code in hubot-hangouts (npm)
1 compromised version
- Nov 13, 2024
Malicious code in http-long-poll-server (npm)
1 compromised version
- Nov 13, 2024
Malicious code in http-long-poll-client (npm)
1 compromised version
- Nov 13, 2024
Malicious code in grpclb-zk (npm)
1 compromised version
- Nov 13, 2024
Malicious code in themes-nunjucks-service (npm)
2 compromised versions
- Nov 13, 2024
Malicious code in ax-proxy-fix (npm)
- Nov 13, 2024
Malware in ax-proxy-fix
1 compromised version
- Nov 13, 2024
Malicious code in tunnelagnt (npm)
- Nov 13, 2024
Malware in tunnelagnt
1 compromised version
- Nov 13, 2024
Malicious code in proxyagnt (npm)
- Nov 13, 2024
Malware in proxyagnt
1 compromised version
- Nov 13, 2024
Malicious code in graphql-yga (npm)
- Nov 13, 2024
Malware in graphql-yga
1 compromised version
- Nov 13, 2024
Malicious code in byted-service-metrics (npm)
1 compromised version
- Nov 13, 2024
Malicious code in byted-lightcharts (npm)
1 compromised version
- Nov 13, 2024
Malware in byted-service-metrics
1 compromised version
- Nov 13, 2024
Malware in byted_service_env
1 compromised version
Page 6057 of 6,646