Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Oct 1, 2024
Malware in express-eval
1 compromised version
- Oct 1, 2024
Malware in express-dompurify
1 compromised version
- Oct 1, 2024
Malware in bcryptutils
1 compromised version
- Sep 30, 2024
Malicious code in hedgedoc-api (npm)
3 compromised versions
- Sep 30, 2024
Malicious code in ens.domains-v2 (npm)
1 compromised version
- Sep 30, 2024
Malicious code in transferwise-iconfont (npm)
1 compromised version
- Sep 30, 2024
Malicious code in world-id-sign-in (npm)
1 compromised version
- Sep 30, 2024
Malicious code in arkose-vue2-example (npm)
1 compromised version
- Sep 30, 2024
Malicious code in evolve-base-assets (npm)
1 compromised version
- Sep 30, 2024
Malicious code in hakka (npm)
1 compromised version
- Sep 30, 2024
Malware in o-layout
1 compromised version
- Sep 30, 2024
Malware in o-forms
1 compromised version
- Sep 30, 2024
Malware in peb_portal
1 compromised version
- Sep 30, 2024
Malware in whatnot_seller_api_docs
1 compromised version
- Sep 30, 2024
Malware in pod-financier-app
1 compromised version
- Sep 30, 2024
Malware in inclusive-ai-dao-website
1 compromised version
- Sep 30, 2024
Malware in fdx-mock-app
1 compromised version
- Sep 30, 2024
Malware in meraki-react-router
1 compromised version
- Sep 30, 2024
Malware in csm-installation-wizard
1 compromised version
- Sep 30, 2024
Malicious code in djangopeopletest (npm)
1 compromised version
- Sep 30, 2024
Malicious code in visionmedia-debug (npm)
1 compromised version
- Sep 30, 2024
Malicious code in jquery-ui-smoothness (npm)
- Sep 30, 2024
Malware in jquery-ui-smoothness
1 compromised version
- Sep 30, 2024
Malware in visionmedia-debug
1 compromised version
- Sep 30, 2024
Malware in font-lato-2-subset
1 compromised version
- Sep 29, 2024
Malicious code in dx-hotels-ui (npm)
1 compromised version
- Sep 29, 2024
Malicious code in o-layout (npm)
1 compromised version
- Sep 29, 2024
Malicious code in peb_portal (npm)
2 compromised versions
- Sep 29, 2024
Malicious code in ds-home (npm)
2 compromised versions
- Sep 29, 2024
Malicious code in @plentyofcode/header-bidding-adslot (npm)
5 compromised versions
- Sep 29, 2024
Malicious code in espace-membre (npm)
1 compromised version
- Sep 28, 2024
Malicious code in @kp-admin/history (npm)
5 compromised versions
- Sep 28, 2024
Malicious code in @gintel/personal-assistant (npm)
1 compromised version
- Sep 28, 2024
Malicious code in @kp-admin/main (npm)
1 compromised version
- Sep 28, 2024
Malicious code in tesgotestpytest-npm-com-test (npm)
1 compromised version
- Sep 28, 2024
Malicious code in vault-assist-tool (npm)
1 compromised version
- Sep 28, 2024
Malicious code in c2-object-storage (npm)
1 compromised version
- Sep 28, 2024
Malicious code in intercom-openapi (npm)
2 compromised versions
- Sep 28, 2024
Malicious code in npm-reporter (npm)
1 compromised version
- Sep 28, 2024
Malicious code in nuvei-commercetools (npm)
1 compromised version
- Sep 28, 2024
Malicious code in repo-private (npm)
1 compromised version
- Sep 28, 2024
Malicious code in gui-timbuctoo-emlo (npm)
1 compromised version
- Sep 28, 2024
Malicious code in textannoviz (npm)
1 compromised version
- Sep 28, 2024
Malicious code in @plentyofcode/reef (npm)
3 compromised versions
- Sep 28, 2024
Malicious code in sbm-react-native-sample (npm)
1 compromised version
- Sep 28, 2024
Malicious code in algolia-analyzer (npm)
1 compromised version
- Sep 28, 2024
Malicious code in site-national-covoiturage (npm)
4 compromised versions
- Sep 28, 2024
Malicious code in alertsorchestration-paypal (npm)
1 compromised version
- Sep 28, 2024
Malicious code in world-id-docs (npm)
3 compromised versions
- Sep 28, 2024
Malicious code in notrealpackage-blac (npm)
1 compromised version
Page 6092 of 6,646