Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Oct 9, 2024
Malicious code in agoda-design-toolkit-2 (npm)
4 compromised versions
- Oct 9, 2024
Malware in sae-viewer
1 compromised version
- Oct 9, 2024
Malware in kubeman
1 compromised version
- Oct 9, 2024
Malware in redis-examples
1 compromised version
- Oct 9, 2024
Malware in sdk-integration-tests
1 compromised version
- Oct 9, 2024
Malware in agoda-design-toolkit-2
1 compromised version
- Oct 9, 2024
Malware in makebetteremail
1 compromised version
- Oct 9, 2024
Malware in nanoslackts-env-test
1 compromised version
- Oct 9, 2024
Malware in backend-engineering-test
1 compromised version
- Oct 9, 2024
Malware in asp.app
1 compromised version
- Oct 9, 2024
Malware in buy-sell-opensea-sdk-demo
1 compromised version
- Oct 9, 2024
Malware in annotation-app
1 compromised version
- Oct 9, 2024
Malware in svelte-hms-world
1 compromised version
- Oct 9, 2024
Malware in videojs-sneakpeek
1 compromised version
- Oct 9, 2024
Malware in juno-composer
1 compromised version
- Oct 9, 2024
Malware in language-rego
1 compromised version
- Oct 9, 2024
Malware in sp-api-app-cdk
1 compromised version
- Oct 9, 2024
Malware in google.fhir.r4.google
1 compromised version
- Oct 9, 2024
Malware in uchiwa
1 compromised version
- Oct 9, 2024
Malware in snyk.io
1 compromised version
- Oct 9, 2024
Malware in branch-extension
1 compromised version
- Oct 9, 2024
Malware in openai-bun-test
1 compromised version
- Oct 8, 2024
Malicious code in navb-pub (npm)
- Oct 8, 2024
Malware in navb-pub
1 compromised version
- Oct 8, 2024
Malicious code in sd-template-main (npm)
5 compromised versions
- Oct 8, 2024
Malicious code in msdhsfhjfj-cli (npm)
1 compromised version
- Oct 8, 2024
Malicious code in @fdp-tools/helm (npm)
1 compromised version
- Oct 8, 2024
Malicious code in @fdp-tools/eslint-formatter (npm)
1 compromised version
- Oct 8, 2024
Malicious code in @fdp-tools/observability (npm)
1 compromised version
- Oct 8, 2024
Malicious code in @fdp-tools/artifactory (npm)
1 compromised version
- Oct 8, 2024
Malicious code in @fdp-tools/bitbucket (npm)
1 compromised version
- Oct 8, 2024
Malicious code in @fdp-tools/snap (npm)
1 compromised version
- Oct 7, 2024
Malicious code in ws-api-typescript-websocket-hooks (npm)
1 compromised version
- Oct 7, 2024
Malicious code in ws-api-typescript-infra (npm)
1 compromised version
- Oct 7, 2024
Malicious code in quantum-visualization (npm)
1 compromised version
- Oct 7, 2024
Malicious code in descriptiongenerator-typescript-runtime (npm)
1 compromised version
- Oct 7, 2024
Malicious code in botframework-webchat-cldr-data-downloader (npm)
1 compromised version
- Oct 7, 2024
Malicious code in ads-api-report-fetcher (npm)
1 compromised version
- Oct 7, 2024
Malicious code in protobufj-cli (npm)
1 compromised version
- Oct 7, 2024
Malicious code in monorepo-releaser (npm)
1 compromised version
- Oct 5, 2024
Malicious code in o-typescript (npm)
1 compromised version
- Oct 5, 2024
Malicious code in no-typescript (npm)
1 compromised version
- Oct 5, 2024
Malicious code in m-typescript (npm)
4 compromised versions
- Oct 5, 2024
Malicious code in lending-vault (npm)
1 compromised version
- Oct 5, 2024
Malicious code in app-monorepo (npm)
1 compromised version
- Oct 5, 2024
Malicious code in discord-api-docs (npm)
1 compromised version
- Oct 5, 2024
Malicious code in bolteu (npm)
3 compromised versions
- Oct 4, 2024
Malicious code in vention-quest (npm)
1 compromised version
- Oct 4, 2024
Malicious code in hulululu (npm)
1 compromised version
- Oct 4, 2024
Malicious code in hilla-components-dependencies (npm)
1 compromised version
Page 6090 of 6,646