Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,299 total in npm · sorted newest first- Oct 28, 2024
Malware in selfcord-js-v14
1 compromised version
- Oct 28, 2024
Malware in selfcord-v14
1 compromised version
- Oct 27, 2024
Malicious code in oneui.angular (npm)
1 compromised version
- Oct 26, 2024
Malicious code in edtttsenuity (npm)
1 compromised version
- Oct 26, 2024
Malicious code in axum-live-view (npm)
1 compromised version
- Oct 24, 2024
Malicious code in wasabicons (npm)
1 compromised version
- Oct 24, 2024
Malicious code in acl-icon-font (npm)
1 compromised version
- Oct 24, 2024
Malware in direct_access_theme
1 compromised version
- Oct 24, 2024
Malicious code in dexter-angular-app (npm)
1 compromised version
- Oct 24, 2024
Malware in dexter-angular-app
1 compromised version
- Oct 24, 2024
Malicious code in viem-aa-sdk-compatible (npm)
- Oct 24, 2024
Malicious code in ak-docgen (npm)
- Oct 24, 2024
Malware in ak-docgen
1 compromised version
- Oct 24, 2024
Malware in capi-param-builder
1 compromised version
- Oct 24, 2024
Malware in viem-aa-sdk-compatible
1 compromised version
- Oct 24, 2024
Malware in nuance-mix
1 compromised version
- Oct 24, 2024
Malicious code in @sixsense/core (npm)
1 compromised version
- Oct 24, 2024
Malicious code in lcnc-app (npm)
4 compromised versions
- Oct 24, 2024
Malicious code in @woody-mrs-potato/utils-banking (npm)
11 compromised versions
- Oct 24, 2024
Malware in ohcm-polymerase
1 compromised version
- Oct 23, 2024
Malicious code in owasp-aasvs-to-readthedocs (npm)
- Oct 23, 2024
Malicious code in git-commit-message-convention (npm)
- Oct 23, 2024
Malware in owasp-aasvs-to-readthedocs
1 compromised version
- Oct 23, 2024
Malware in git-commit-message-convention
1 compromised version
- Oct 23, 2024
Malicious code in sling-sdk (npm)
3 compromised versions
- Oct 22, 2024
Malicious code in ohcm-polymerase (npm)
2 compromised versions
- Oct 22, 2024
Malicious code in pwn2day-shell (npm)
3 compromised versions
- Oct 22, 2024
Malicious code in @wf-wfmfe/pxp (npm)
1 compromised version
- Oct 22, 2024
Malicious code in xcampaigntracker (npm)
1 compromised version
- Oct 22, 2024
Malicious code in mcroutingservice (npm)
1 compromised version
- Oct 22, 2024
Malware in viajemos
1 compromised version
- Oct 22, 2024
Malicious code in semantic-release-commit-rules (npm)
- Oct 22, 2024
Malicious code in module-with-node-gyp (npm)
- Oct 22, 2024
Malicious code in eslint-plugin-no-unsafe (npm)
- Oct 22, 2024
Malware in semantic-release-commit-rules
1 compromised version
- Oct 22, 2024
Malware in module-with-node-gyp
1 compromised version
- Oct 22, 2024
Malware in eslint-plugin-no-unsafe
1 compromised version
- Oct 22, 2024
Malware in module-with-prebuild
1 compromised version
- Oct 22, 2024
Malware in eslint-config-bc
1 compromised version
- Oct 22, 2024
Malware in native-module2
1 compromised version
- Oct 22, 2024
Malware in test-automation-testing
1 compromised version
- Oct 22, 2024
Malicious code in monday-react-quickstart-app (npm)
- Oct 22, 2024
Malware in roblox-creator-docs
1 compromised version
- Oct 22, 2024
Malware in monday-react-quickstart-app
1 compromised version
- Oct 22, 2024
Malicious code in csm-docs (npm)
- Oct 22, 2024
Malware in csm-docs
1 compromised version
- Oct 22, 2024
Malicious code in nuance-mix (npm)
1 compromised version
- Oct 22, 2024
Malicious code in reqstus (npm)
- Oct 22, 2024
Malware in reqstus
1 compromised version
- Oct 21, 2024
Malicious code in sn-flow-client (npm)
4 compromised versions
Page 6068 of 6,646