Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Oct 16, 2024
Malicious code in auth0-lock-browserify (npm)
1 compromised version
- Oct 16, 2024
Malicious code in auth-oauth-device (npm)
1 compromised version
- Oct 16, 2024
Malicious code in atlassian-static-assets-url-plugin (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in atlassian-oauth2-plugin (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in aswieos (npm)
1 compromised version
- Oct 16, 2024
Malicious code in assets-registry (npm)
1 compromised version
- Oct 16, 2024
Malicious code in assetiq-kudu-node (npm)
1 compromised version
- Oct 16, 2024
Malicious code in aspernatur-pariatur-occaecati (npm)
1 compromised version
- Oct 16, 2024
Malicious code in apidevtools (npm)
1 compromised version
- Oct 16, 2024
Malicious code in api-extractor-model (npm)
1 compromised version
- Oct 16, 2024
Malicious code in nuxtjs_axios (npm)
1 compromised version
- Oct 16, 2024
Malicious code in android-x64 (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in android-arm64 (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in android-arm (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in alexablueprintswizard (npm)
4 compromised versions
- Oct 16, 2024
Malicious code in aix-ppc64 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in ahmedwael00 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in agora-rtc-web (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in aggregate-rose-booby (npm)
1 compromised version
- Oct 16, 2024
Malicious code in acceptable-purple-sheep (npm)
1 compromised version
- Oct 16, 2024
Malicious code in acceptable-emerald-ladybug (npm)
1 compromised version
- Oct 16, 2024
Malicious code in able-lime-albatross (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @zva/web (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in @zhiend989/asdfqwer (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/voidray-sdk-addon-media-recorder (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/voidray-sdk-addon-map-file (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/voidray-sdk-addon-disk-image-write (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/voidray-sdk-addon-disk-image-browse (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/voidray-sdk-addon-audio (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/voidray-sdk (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/asdfqwer (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/adx-jetstream-util (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @usaa-grp-inf-presentation/usaa-tw-base (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in @usaa-grp-inf-presentation/usaa-tw-apps (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @usaa-grp-inf-presentation/browserslist-config-usaa (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @taxify/trippricingopt (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in @taxify/taxify-code-utils (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in @taxify/redux-session (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in @taxify/price-estimate-helper-models (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in @taxify/nodejs-common (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in @snapchat-web-calling/app (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @shwetkhushi/field-group (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @pcid/client-request-builder (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @no1xsalman/dompubsub (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @mwrc/a (npm)
4 compromised versions
- Oct 16, 2024
Malicious code in @msaaqcom/masaqtest (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @iceberg-react/test-package (npm)
4 compromised versions
- Oct 16, 2024
Malicious code in @galaxy-joy/loy.api.core (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @frontend-performance/image-lazy-loading (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @daimler-rcms/api-client (npm)
1 compromised version
Page 6082 of 6,646