Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,299 total in npm · sorted newest first- Oct 30, 2024
Malware in roboter
1 compromised version
- Oct 30, 2024
Malware in eslint-config-ezugi
1 compromised version
- Oct 30, 2024
Malware in se-testing
1 compromised version
- Oct 29, 2024
Malicious code in herthtrhrt (npm)
- Oct 29, 2024
Malicious code in gerhtreger (npm)
1 compromised version
- Oct 29, 2024
Malware in herthtrhrt
1 compromised version
- Oct 29, 2024
Malware in gerhtreger
1 compromised version
- Oct 29, 2024
Malicious code in ui-tooltip (npm)
2 compromised versions
- Oct 29, 2024
Malicious code in custom-ui-extension-template (npm)
1 compromised version
- Oct 29, 2024
Malicious code in celtra-auto-exporter (npm)
1 compromised version
- Oct 29, 2024
Malicious code in dragonhack-workshop (npm)
1 compromised version
- Oct 29, 2024
Malicious code in webhooks-resources-nodejs-server (npm)
- Oct 29, 2024
Malicious code in plain-headless-portal (npm)
- Oct 29, 2024
Malicious code in kbc-ui.templates (npm)
1 compromised version
- Oct 29, 2024
Malware in webhooks-resources-nodejs-server
1 compromised version
- Oct 29, 2024
Malware in kbc-ui.templates
1 compromised version
- Oct 29, 2024
Malware in buildkit-discourse-integration
1 compromised version
- Oct 29, 2024
Malware in nf-gestures
1 compromised version
- Oct 29, 2024
Malware in plain-headless-portal
1 compromised version
- Oct 29, 2024
Malicious code in metadata-attacher (npm)
1 compromised version
- Oct 29, 2024
Malware in metadata-attacher
1 compromised version
- Oct 28, 2024
Malicious code in eslint-plugin-evo (npm)
1 compromised version
- Oct 28, 2024
Malicious code in roboter (npm)
1 compromised version
- Oct 28, 2024
Malicious code in buildkit-discourse-integration (npm)
1 compromised version
- Oct 28, 2024
Malicious code in videoads-util-misc-general (npm)
- Oct 28, 2024
Malicious code in meso-event-queue (npm)
- Oct 28, 2024
Malware in meso-event-queue
1 compromised version
- Oct 28, 2024
Malware in videoads-util-misc-general
1 compromised version
- Oct 28, 2024
Malware in blank-fe
1 compromised version
- Oct 28, 2024
Malicious code in tds-styled-docs (npm)
- Oct 28, 2024
Malware in tds-styled-docs
1 compromised version
- Oct 28, 2024
Malicious code in req-scope (npm)
- Oct 28, 2024
Malicious code in req-ban (npm)
1 compromised version
- Oct 28, 2024
Malware in req-ban
1 compromised version
- Oct 28, 2024
Malware in req-scope
1 compromised version
- Oct 28, 2024
Malicious code in visma-connect-bv (npm)
1 compromised version
- Oct 28, 2024
Malicious code in offensive-security (npm)
1 compromised version
- Oct 28, 2024
Malicious code in luzmo (npm)
1 compromised version
- Oct 28, 2024
Malicious code in ing-friam (npm)
1 compromised version
- Oct 28, 2024
Malicious code in blueconic (npm)
1 compromised version
- Oct 28, 2024
Malware in luzmo
1 compromised version
- Oct 28, 2024
Malware in visma-connect-bv
1 compromised version
- Oct 28, 2024
Malware in offensive-security
1 compromised version
- Oct 28, 2024
Malware in aspera-ui
1 compromised version
- Oct 28, 2024
Malware in tomorrowland
1 compromised version
- Oct 28, 2024
Malware in ing-friam
1 compromised version
- Oct 28, 2024
Malware in blueconic
1 compromised version
- Oct 28, 2024
Malware in arangodb
1 compromised version
- Oct 28, 2024
Malicious code in selfcord-v14 (npm)
- Oct 28, 2024
Malicious code in selfcord-js-v14 (npm)
Page 6067 of 6,646