Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Oct 11, 2024
Malicious code in cbdev2024test (npm)
14 compromised versions
- Oct 11, 2024
Malware in cbdev2024test
1 compromised version
- Oct 11, 2024
Malware in gcp-monitor-prod
1 compromised version
- Oct 11, 2024
Malicious code in request-ip-validator (npm)
- Oct 11, 2024
Malicious code in request-ip-check (npm)
6 compromised versions
- Oct 11, 2024
Malware in request-ip-check
1 compromised version
- Oct 11, 2024
Malware in request-ip-validator
1 compromised version
- Oct 10, 2024
Malicious code in pt-validate (npm)
60 compromised versions
- Oct 10, 2024
Malware in pt-validate
1 compromised version
- Oct 10, 2024
Malicious code in todomvc-app-css-alt (npm)
- Oct 10, 2024
Malware in todomvc-app-css-alt
1 compromised version
- Oct 10, 2024
Malware in sd-template-main
1 compromised version
- Oct 10, 2024
Malicious code in duckc2-v5.3.6 (npm)
- Oct 10, 2024
Malicious code in duckc2-v5.3.5 (npm)
- Oct 10, 2024
Malicious code in duckc2-v5.3.3 (npm)
- Oct 10, 2024
Malicious code in duckc2-v5.2.3 (npm)
- Oct 10, 2024
Malware in duckc2-v5.2.3
1 compromised version
- Oct 10, 2024
Malware in duckc2-v5.3.6
1 compromised version
- Oct 10, 2024
Malware in duckc2-v5.3.3
1 compromised version
- Oct 10, 2024
Malware in duckc2-v5.3.5
1 compromised version
- Oct 10, 2024
Malicious code in sukuna-panel (npm)
- Oct 10, 2024
Malicious code in duckc2-v5.2 (npm)
- Oct 10, 2024
Malicious code in duckc2-moons (npm)
- Oct 10, 2024
Malicious code in duckc2-apis (npm)
1 compromised version
- Oct 10, 2024
Malicious code in duckc2-api (npm)
1 compromised version
- Oct 10, 2024
Malicious code in duckc2 (npm)
1 compromised version
- Oct 10, 2024
Malware in duckc2
1 compromised version
- Oct 10, 2024
Malware in sukuna-panel
1 compromised version
- Oct 10, 2024
Malware in duckc2-moons
1 compromised version
- Oct 10, 2024
Malware in duckc2-apis
1 compromised version
- Oct 10, 2024
Malware in duckc2-v5.2
1 compromised version
- Oct 10, 2024
Malware in duckc2-api
1 compromised version
- Oct 10, 2024
Malicious code in @copilot-web-widgets/ai-writer (npm)
4 compromised versions
- Oct 10, 2024
Malicious code in @erc6900/reference-implementation (npm)
1 compromised version
- Oct 10, 2024
Malicious code in @copilot-web-widgets/common-core-sdk (npm)
7 compromised versions
- Oct 10, 2024
Malicious code in manoj-app-css-alt (npm)
1 compromised version
- Oct 10, 2024
Malware in meditek
1 compromised version
- Oct 10, 2024
Malicious code in mohamedsaqib (npm)
1 compromised version
- Oct 10, 2024
Malware in mohamedsaqib
1 compromised version
- Oct 10, 2024
Malicious code in prismjs-editor-v2 (npm)
8 compromised versions
- Oct 10, 2024
Malware in prismjs-editor-v2
1 compromised version
- Oct 10, 2024
Malicious code in typescript-error-reporter-action (npm)
1 compromised version
- Oct 10, 2024
Malicious code in sendbird_chat_sdk (npm)
- Oct 10, 2024
Malicious code in sendbird-hubs (npm)
2 compromised versions
- Oct 10, 2024
Malicious code in redux-init (npm)
- Oct 10, 2024
Malicious code in jacoco-report (npm)
1 compromised version
- Oct 10, 2024
Malicious code in hubs-admin (npm)
2 compromised versions
- Oct 10, 2024
Malicious code in com.sendbird.calls (npm)
2 compromised versions
- Oct 10, 2024
Malware in hubs-admin
1 compromised version
- Oct 10, 2024
Malware in typescript-error-reporter-action
1 compromised version
Page 6084 of 6,646