Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,299 total in npm · sorted newest first- Oct 31, 2024
Malicious code in allocations-ui (npm)
1 compromised version
- Oct 31, 2024
Malicious code in @amagioss/js-timecode (npm)
1 compromised version
- Oct 31, 2024
Malicious code in blossom-flex-ui (npm)
1 compromised version
- Oct 31, 2024
Malicious code in gyaani (npm)
- Oct 31, 2024
Malware in gyaani
1 compromised version
- Oct 31, 2024
Malware in toolspacks
1 compromised version
- Oct 31, 2024
Malware in ship_sleepnpm-tool
1 compromised version
- Oct 31, 2024
Malicious code in freshchange (npm)
1 compromised version
- Oct 31, 2024
Malware in freshchange
1 compromised version
- Oct 31, 2024
Malware in custom-ui-extension-template
1 compromised version
- Oct 31, 2024
Malware in dragonhack-workshop
1 compromised version
- Oct 31, 2024
Malware in celtra-auto-exporter
1 compromised version
- Oct 30, 2024
Malicious code in cms-core-redux (npm)
1 compromised version
- Oct 30, 2024
Malicious code in cms-ti-components (npm)
1 compromised version
- Oct 30, 2024
Malicious code in cms-hpti-components (npm)
1 compromised version
- Oct 30, 2024
Malicious code in directv (npm)
1 compromised version
- Oct 30, 2024
Malicious code in opdistube (npm)
2 compromised versions
- Oct 30, 2024
Malicious code in upgrade-roblox (npm)
2 compromised versions
- Oct 30, 2024
Malicious code in testinbro (npm)
1 compromised version
- Oct 30, 2024
Malicious code in solaraupdater (npm)
1 compromised version
- Oct 30, 2024
Malicious code in robloxbootstrapper (npm)
1 compromised version
- Oct 30, 2024
Malicious code in ro.dll (npm)
1 compromised version
- Oct 30, 2024
Malicious code in nodelogic (npm)
1 compromised version
- Oct 30, 2024
Malicious code in nodelement (npm)
1 compromised version
- Oct 30, 2024
Malicious code in node-dlls (npm)
1 compromised version
- Oct 30, 2024
Malicious code in inject.dll (npm)
2 compromised versions
- Oct 30, 2024
Malicious code in easy-upgrade (npm)
1 compromised version
- Oct 30, 2024
Malicious code in celexkeygen (npm)
1 compromised version
- Oct 30, 2024
Malicious code in byfron (npm)
1 compromised version
- Oct 30, 2024
Malicious code in bloxupgrade (npm)
1 compromised version
- Oct 30, 2024
Malicious code in autoadv (npm)
1 compromised version
- Oct 30, 2024
Malicious code in @cb-global-design-system-tokens/tailwind (npm)
4 compromised versions
- Oct 30, 2024
Malicious code in @wf-wfria/ria-analytics (npm)
10 compromised versions
- Oct 30, 2024
Malicious code in test-package2345 (npm)
1 compromised version
- Oct 30, 2024
Malicious code in orb-sync-lib (npm)
4 compromised versions
- Oct 30, 2024
Malicious code in req-bans (npm)
1 compromised version
- Oct 30, 2024
Malware in req-bans
1 compromised version
- Oct 30, 2024
Malicious code in req-scopes (npm)
3 compromised versions
- Oct 30, 2024
Malware in req-scopes
1 compromised version
- Oct 30, 2024
Malicious code in xk6-toml (npm)
1 compromised version
- Oct 30, 2024
Malicious code in princedevmd1 (npm)
- Oct 30, 2024
Malicious code in lessc-rhino (npm)
1 compromised version
- Oct 30, 2024
Malware in lessc-rhino
1 compromised version
- Oct 30, 2024
Malware in princedevmd1
1 compromised version
- Oct 30, 2024
Malware in xk6-toml
1 compromised version
- Oct 30, 2024
Malicious code in react-native-blue-crypto (npm)
2 compromised versions
- Oct 30, 2024
Malware in react-native-blue-crypto
1 compromised version
- Oct 30, 2024
Malware in eslint-plugin-evo
1 compromised version
- Oct 30, 2024
Malicious code in se-testing (npm)
2 compromised versions
- Oct 30, 2024
Malicious code in eslint-config-ezugi (npm)
Page 6066 of 6,646