Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Oct 16, 2024
Malicious code in exporter-trace-otlp-proto (npm)
1 compromised version
- Oct 16, 2024
Malicious code in exporter-trace-otlp-http (npm)
1 compromised version
- Oct 16, 2024
Malicious code in export-gltf (npm)
1 compromised version
- Oct 16, 2024
Malicious code in experimental-purple-walrus (npm)
1 compromised version
- Oct 16, 2024
Malicious code in executor-http (npm)
1 compromised version
- Oct 16, 2024
Malicious code in example-gtm (npm)
1 compromised version
- Oct 16, 2024
Malicious code in ewueirit (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eventstream-serde-universal (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eventstream-serde-config-resolver (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eventstream-serde-browser (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eventstream-codec (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eum-veritatis-placeat (npm)
1 compromised version
- Oct 16, 2024
Malicious code in ethnic-purple-iguana (npm)
1 compromised version
- Oct 16, 2024
Malicious code in esse-praesentium-eligendi (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eslint-v7 (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in esbuild-plugin-global-externals (npm)
1 compromised version
- Oct 16, 2024
Malicious code in env-debug-logger (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in elements-homefeeds (npm)
1 compromised version
- Oct 16, 2024
Malicious code in elastic-otel-node (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eighster (npm)
1 compromised version
- Oct 16, 2024
Malicious code in dying-beige-gazelle (npm)
1 compromised version
- Oct 16, 2024
Malicious code in dwoeoer (npm)
1 compromised version
- Oct 16, 2024
Malicious code in dt-app112 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in dp-bpsc-tiktok-music (npm)
1 compromised version
- Oct 16, 2024
Malicious code in dominant-sapphire-dolphin (npm)
1 compromised version
- Oct 16, 2024
Malicious code in do-not-install-ecb1029ca (npm)
1 compromised version
- Oct 16, 2024
Malicious code in djs14-logger (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in directlinetoactionsongooglelib (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in dhoeiwoe (npm)
1 compromised version
- Oct 16, 2024
Malicious code in dfx-api (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in dependent-maroon-bovid (npm)
1 compromised version
- Oct 16, 2024
Malicious code in dep_malc (npm)
1 compromised version
- Oct 16, 2024
Malicious code in deeperscan-nft (npm)
1 compromised version
- Oct 16, 2024
Malicious code in decisive-salmon-worm (npm)
1 compromised version
- Oct 16, 2024
Malicious code in cwoeuor (npm)
1 compromised version
- Oct 16, 2024
Malicious code in css-tokenizer (npm)
1 compromised version
- Oct 16, 2024
Malicious code in crowdin-cli-website (npm)
1 compromised version
- Oct 16, 2024
Malicious code in crispler (npm)
1 compromised version
- Oct 16, 2024
Malicious code in crisping (npm)
1 compromised version
- Oct 16, 2024
Malicious code in credential-provider-http (npm)
1 compromised version
- Oct 16, 2024
Malicious code in corporate-pro (npm)
1 compromised version
- Oct 16, 2024
Malicious code in core-linux-x64-musl (npm)
1 compromised version
- Oct 16, 2024
Malicious code in context-async-hooks (npm)
1 compromised version
- Oct 16, 2024
Malicious code in conservation-pink-armadillo (npm)
1 compromised version
- Oct 16, 2024
Malicious code in confluence-search-ui (npm)
1 compromised version
- Oct 16, 2024
Malicious code in confluence-frontend (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in config.env-replace (npm)
1 compromised version
- Oct 16, 2024
Malicious code in config-conventional (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in compulsory-harlequin-ant (npm)
1 compromised version
- Oct 16, 2024
Malicious code in competent-violet-dolphin (npm)
1 compromised version
Page 6080 of 6,646