Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Oct 16, 2024
Malicious code in minimum-fuchsia-cattle (npm)
1 compromised version
- Oct 16, 2024
Malicious code in miesjdheo (npm)
1 compromised version
- Oct 16, 2024
Malicious code in middleware-sdk-sqs (npm)
1 compromised version
- Oct 16, 2024
Malicious code in middleware-location-constraint (npm)
1 compromised version
- Oct 16, 2024
Malicious code in middleware-flexible-checksums (npm)
1 compromised version
- Oct 16, 2024
Malicious code in middleware-expect-continue (npm)
1 compromised version
- Oct 16, 2024
Malicious code in mid-jade-prawn (npm)
1 compromised version
- Oct 16, 2024
Malicious code in media-query-list-parser (npm)
1 compromised version
- Oct 16, 2024
Malicious code in mdx2-csf (npm)
1 compromised version
- Oct 16, 2024
Malicious code in math-power-dev (npm)
1 compromised version
- Oct 16, 2024
Malicious code in masterfresh (npm)
1 compromised version
- Oct 16, 2024
Malicious code in marvellous-turquoise-haddock (npm)
1 compromised version
- Oct 16, 2024
Malicious code in marked-amaranth-mastodon (npm)
1 compromised version
- Oct 16, 2024
Malicious code in manypkg (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in manojmac1 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in lumener (npm)
1 compromised version
- Oct 16, 2024
Malicious code in luekria (npm)
1 compromised version
- Oct 16, 2024
Malicious code in lowieor (npm)
1 compromised version
- Oct 16, 2024
Malicious code in localier (npm)
1 compromised version
- Oct 16, 2024
Malicious code in linux-ppc64 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in linux-loong64 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in linguistic-beige-mule (npm)
1 compromised version
- Oct 16, 2024
Malicious code in lineluders (npm)
1 compromised version
- Oct 16, 2024
Malicious code in lido-mev-monitoring (npm)
1 compromised version
- Oct 16, 2024
Malicious code in lido-council-daemon (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in lib-storage (npm)
1 compromised version
- Oct 16, 2024
Malicious code in lib-dynamodb (npm)
1 compromised version
- Oct 16, 2024
Malicious code in level-crimson-seahorse (npm)
1 compromised version
- Oct 16, 2024
Malicious code in laweuf (npm)
1 compromised version
- Oct 16, 2024
Malicious code in late-amethyst-gecko (npm)
1 compromised version
- Oct 16, 2024
Malicious code in laloumpackk (npm)
5 compromised versions
- Oct 16, 2024
Malicious code in kowieo (npm)
1 compromised version
- Oct 16, 2024
Malicious code in known-lavender-dog (npm)
1 compromised version
- Oct 16, 2024
Malicious code in killrido (npm)
1 compromised version
- Oct 16, 2024
Malicious code in jwieo (npm)
1 compromised version
- Oct 16, 2024
Malicious code in jsdevtools (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in js-rust-grpc-quotes (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in jittery-chocolate-hoverfly (npm)
1 compromised version
- Oct 16, 2024
Malicious code in jiopeyrie (npm)
1 compromised version
- Oct 16, 2024
Malicious code in isomorphic-random-example (npm)
1 compromised version
- Oct 16, 2024
Malicious code in invisible-red-leopard (npm)
1 compromised version
- Oct 16, 2024
Malicious code in integrated-magenta-pigeon (npm)
1 compromised version
- Oct 16, 2024
Malicious code in instrumentation-pg (npm)
1 compromised version
- Oct 16, 2024
Malicious code in instrumentation-ioredis (npm)
1 compromised version
- Oct 16, 2024
Malicious code in instrumentation-grpc (npm)
1 compromised version
- Oct 16, 2024
Malicious code in instrumentation-express (npm)
1 compromised version
- Oct 16, 2024
Malicious code in incendiumrocks (npm)
1 compromised version
- Oct 16, 2024
Malicious code in import-wasm-static (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in imperial-maroon-dolphin (npm)
1 compromised version
- Oct 16, 2024
Malicious code in illum-perferendis-consectetur (npm)
1 compromised version
Page 6078 of 6,646