Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Oct 16, 2024
Malicious code in website-next (npm)
1 compromised version
- Oct 16, 2024
Malicious code in wbtvd-screeners-web (npm)
1 compromised version
- Oct 16, 2024
Malicious code in vwirow (npm)
1 compromised version
- Oct 16, 2024
Malicious code in vskiwe (npm)
1 compromised version
- Oct 16, 2024
Malicious code in vsieor (npm)
1 compromised version
- Oct 16, 2024
Malicious code in vortexter (npm)
1 compromised version
- Oct 16, 2024
Malicious code in viwoeise (npm)
1 compromised version
- Oct 16, 2024
Malicious code in visual-aqua-amphibian (npm)
1 compromised version
- Oct 16, 2024
Malicious code in viona-atm (npm)
1 compromised version
- Oct 16, 2024
Malicious code in vio-atm (npm)
10 compromised versions
- Oct 16, 2024
Malicious code in vendiror (npm)
1 compromised version
- Oct 16, 2024
Malicious code in uwioer (npm)
1 compromised version
- Oct 16, 2024
Malicious code in uuiidv2 (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in utils.logger (npm)
1 compromised version
- Oct 16, 2024
Malicious code in utils-define-nonenumerable-read-only-property (npm)
1 compromised version
- Oct 16, 2024
Malicious code in util-waiter (npm)
1 compromised version
- Oct 16, 2024
Malicious code in util-stream (npm)
1 compromised version
- Oct 16, 2024
Malicious code in util-format-url (npm)
1 compromised version
- Oct 16, 2024
Malicious code in util-dynamodb (npm)
1 compromised version
- Oct 16, 2024
Malicious code in util-arn-parser (npm)
1 compromised version
- Oct 16, 2024
Malicious code in unwilling-emerald-bonobo (npm)
1 compromised version
- Oct 16, 2024
Malicious code in untoueire (npm)
1 compromised version
- Oct 16, 2024
Malicious code in unchanged-azure-limpet (npm)
1 compromised version
- Oct 16, 2024
Malicious code in uncertain-orange-snake (npm)
1 compromised version
- Oct 16, 2024
Malicious code in ui-datepicker-week-end (npm)
1 compromised version
- Oct 16, 2024
Malicious code in typescript52 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in typescript-operations (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in translate-readme (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in to-lines (npm)
1 compromised version
- Oct 16, 2024
Malicious code in tioowur (npm)
1 compromised version
- Oct 16, 2024
Malicious code in thin-bronze-magpie (npm)
1 compromised version
- Oct 16, 2024
Malicious code in theme-one-dark (npm)
1 compromised version
- Oct 16, 2024
Malicious code in thefisherp (npm)
1 compromised version
- Oct 16, 2024
Malicious code in thefisheridx (npm)
1 compromised version
- Oct 16, 2024
Malicious code in testtest04 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in testtest01 (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in test_lykos2 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in test-tech-talk (npm)
1 compromised version
- Oct 16, 2024
Malicious code in temporary-beige-mandrill (npm)
1 compromised version
- Oct 16, 2024
Malicious code in symphony-scatterplot (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in swieuoer (npm)
1 compromised version
- Oct 16, 2024
Malicious code in surprising-amaranth-mastodon (npm)
1 compromised version
- Oct 16, 2024
Malicious code in super-aqua-canidae (npm)
1 compromised version
- Oct 16, 2024
Malicious code in supabase-js (npm)
4 compromised versions
- Oct 16, 2024
Malicious code in string-locale-compare (npm)
1 compromised version
- Oct 16, 2024
Malicious code in str-or-num (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in statistical-moccasin-caribou (npm)
1 compromised version
- Oct 16, 2024
Malicious code in ssr-dom-shim (npm)
1 compromised version
- Oct 16, 2024
Malicious code in ssc-oauth2 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in squealing-green-coyote (npm)
1 compromised version
Page 6074 of 6,646