Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Oct 4, 2024
Malicious code in vue-assignment (npm)
1 compromised version
- Oct 4, 2024
Malicious code in reference-implementation (npm)
1 compromised version
- Oct 4, 2024
Malicious code in @test3.svt/first-npm-package-test-2 (npm)
13 compromised versions
- Oct 4, 2024
Malicious code in @linx-ui/pharmacy (npm)
1 compromised version
- Oct 4, 2024
Malicious code in @linx-ui/shared (npm)
1 compromised version
- Oct 4, 2024
Malicious code in @linx-ui/admin (npm)
1 compromised version
- Oct 3, 2024
Malicious code in deferred-initialization (npm)
1 compromised version
- Oct 3, 2024
Malicious code in hotels-widget (npm)
1 compromised version
- Oct 3, 2024
Malicious code in should_be_whitelisted.js (npm)
1 compromised version
- Oct 3, 2024
Malicious code in @test3.svt/first-npm-package-test (npm)
6 compromised versions
- Oct 3, 2024
Malicious code in kupo-app-secure-store-plugin (npm)
1 compromised version
- Oct 3, 2024
Malicious code in interactive-app (npm)
1 compromised version
- Oct 3, 2024
Malicious code in aou-ui (npm)
2 compromised versions
- Oct 3, 2024
Malicious code in kupo-capacitor-statusbar-safe-area (npm)
1 compromised version
- Oct 2, 2024
Malicious code in speech-to-speech-demo (npm)
1 compromised version
- Oct 2, 2024
Malicious code in electron-release-clerk (npm)
1 compromised version
- Oct 2, 2024
Malicious code in com.lootlocker.lootlockersdk (npm)
1 compromised version
- Oct 2, 2024
Malicious code in ember-deep-addon (npm)
1 compromised version
- Oct 2, 2024
Malicious code in @b2bneo/components-tabs (npm)
1 compromised version
- Oct 2, 2024
Malware in verida-tech-demos
1 compromised version
- Oct 2, 2024
Malware in site-national-covoiturage
1 compromised version
- Oct 2, 2024
Malicious code in dsp_login_front (npm)
1 compromised version
- Oct 2, 2024
Malware in dsp_login_front
1 compromised version
- Oct 2, 2024
Malicious code in express-core-cache (npm)
- Oct 2, 2024
Malware in express-core-cache
1 compromised version
- Oct 2, 2024
Malicious code in cookie_info (npm)
- Oct 2, 2024
Malware in cookie_info
1 compromised version
- Oct 2, 2024
Malicious code in verida-tech-demos (npm)
1 compromised version
- Oct 1, 2024
Malicious code in cloudflare-docs-starlight (npm)
2 compromised versions
- Oct 1, 2024
Malicious code in algoliasearch-v5 (npm)
1 compromised version
- Oct 1, 2024
Malicious code in @facetca/facet-mmleditor (npm)
2 compromised versions
- Oct 1, 2024
Malicious code in nf-cl-logger (npm)
1 compromised version
- Oct 1, 2024
Malicious code in axp-product-ducks (npm)
1 compromised version
- Oct 1, 2024
Malicious code in xto10x (npm)
1 compromised version
- Oct 1, 2024
Malware in xto10x
1 compromised version
- Oct 1, 2024
Malicious code in wagmi-toolkit (npm)
- Oct 1, 2024
Malware in wagmi-toolkit
1 compromised version
- Oct 1, 2024
Malware in labelv2
1 compromised version
- Oct 1, 2024
Malicious code in thirdweb-eats (npm)
- Oct 1, 2024
Malicious code in steampipe-reports (npm)
- Oct 1, 2024
Malicious code in nodedum (npm)
- Oct 1, 2024
Malicious code in document-sample (npm)
- Oct 1, 2024
Malware in document-sample
1 compromised version
- Oct 1, 2024
Malware in atomic-swap
1 compromised version
- Oct 1, 2024
Malware in nodedum
1 compromised version
- Oct 1, 2024
Malware in steampipe-reports
1 compromised version
- Oct 1, 2024
Malware in thirdweb-eats
1 compromised version
- Oct 1, 2024
Malicious code in express-eval (npm)
18 compromised versions
- Oct 1, 2024
Malicious code in express-dompurify (npm)
- Oct 1, 2024
Malicious code in bcryptutils (npm)
Page 6091 of 6,646