Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Oct 16, 2024
Malicious code in sap-admin (npm)
1 compromised version
- Oct 16, 2024
Malicious code in sap-admid (npm)
1 compromised version
- Oct 16, 2024
Malicious code in sap-adduser (npm)
1 compromised version
- Oct 16, 2024
Malicious code in sap-actions (npm)
1 compromised version
- Oct 16, 2024
Malicious code in s-quack (npm)
1 compromised version
- Oct 16, 2024
Malicious code in rustc_codegen_cranelift-github-release (npm)
4 compromised versions
- Oct 16, 2024
Malicious code in rs-downloaders (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in rs-downloader (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in routesmap (npm)
1 compromised version
- Oct 16, 2024
Malicious code in romantic-white-skink (npm)
1 compromised version
- Oct 16, 2024
Malicious code in rollup-linux-x64-gnu (npm)
1 compromised version
- Oct 16, 2024
Malicious code in rollup-darwin-x64 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in nuxtjs_dotenv (npm)
1 compromised version
- Oct 16, 2024
Malicious code in rigid-bronze-mammal (npm)
1 compromised version
- Oct 16, 2024
Malicious code in resolve-extends (npm)
1 compromised version
- Oct 16, 2024
Malicious code in replaceyourbuild (npm)
1 compromised version
- Oct 16, 2024
Malicious code in register_zellepay (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in region-config-resolver (npm)
1 compromised version
- Oct 16, 2024
Malicious code in real-aquamarine-bird (npm)
1 compromised version
- Oct 16, 2024
Malicious code in react-visually-hidden (npm)
1 compromised version
- Oct 16, 2024
Malicious code in react-use-notify (npm)
1 compromised version
- Oct 16, 2024
Malicious code in react-separator (npm)
1 compromised version
- Oct 16, 2024
Malicious code in react-native-playstation (npm)
1 compromised version
- Oct 16, 2024
Malicious code in react-native-community (npm)
1 compromised version
- Oct 16, 2024
Malicious code in react-and-rockets (npm)
1 compromised version
- Oct 16, 2024
Malicious code in racial-crimson-lark (npm)
1 compromised version
- Oct 16, 2024
Malicious code in quivoir (npm)
1 compromised version
- Oct 16, 2024
Malicious code in quae-dolore-nostrum (npm)
1 compromised version
- Oct 16, 2024
Malicious code in qowuer (npm)
1 compromised version
- Oct 16, 2024
Malicious code in qeiorr (npm)
1 compromised version
- Oct 16, 2024
Malicious code in proposed-apricot-lark (npm)
1 compromised version
- Oct 16, 2024
Malicious code in propagator-jaeger (npm)
1 compromised version
- Oct 16, 2024
Malicious code in probable-maroon-roundworm (npm)
1 compromised version
- Oct 16, 2024
Malicious code in princedevmt-test-2 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in princedevmt-test-1 (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in princedevmt-test (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in primitive-ivory-sole (npm)
1 compromised version
- Oct 16, 2024
Malicious code in preview-api (npm)
1 compromised version
- Oct 16, 2024
Malicious code in preferred-copper-manatee (npm)
1 compromised version
- Oct 16, 2024
Malicious code in preact-debug (npm)
1 compromised version
- Oct 16, 2024
Malicious code in pocblablacat (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plumerie (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-warn-if-update-available (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-vue-jsx (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-unicode-sets-regex (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-unicode-property-regex (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-private-property-in-object (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-private-methods (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-optional-chaining (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-object-rest-spread (npm)
1 compromised version
Page 6076 of 6,646