Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Sep 26, 2024
Malicious code in collaborator-trigger05 (npm)
2 compromised versions
- Sep 26, 2024
Malicious code in dx-shared-schema (npm)
3 compromised versions
- Sep 26, 2024
Malware in dx-shared-schema
1 compromised version
- Sep 25, 2024
Malicious code in @dp-bpsc-tiktok/ogc-analytics (npm)
1 compromised version
- Sep 25, 2024
Malicious code in b2b-buyer-portal (npm)
2 compromised versions
- Sep 25, 2024
Malicious code in case-result-reporter (npm)
1 compromised version
- Sep 25, 2024
Malicious code in common-icons (npm)
3 compromised versions
- Sep 25, 2024
Malicious code in visa-ui-angular (npm)
1 compromised version
- Sep 25, 2024
Malicious code in k0m3g4-test (npm)
2 compromised versions
- Sep 25, 2024
Malicious code in uikit-app-promotions-sample (npm)
- Sep 25, 2024
Malicious code in sendbird-uikit-gpt (npm)
- Sep 25, 2024
Malicious code in quickstart-calls-chat-integration (npm)
- Sep 25, 2024
Malicious code in internet-header (npm)
- Sep 25, 2024
Malicious code in design-system-migrations (npm)
- Sep 25, 2024
Malicious code in design-system-intranet-header-workspace (npm)
- Sep 25, 2024
Malicious code in design-system-components-angular (npm)
- Sep 25, 2024
Malicious code in com.sendbird.chat (npm)
- Sep 25, 2024
Malicious code in cktool.target.nodejs (npm)
- Sep 25, 2024
Malware in uikit-app-promotions-sample
1 compromised version
- Sep 25, 2024
Malware in design-system-intranet-header-workspace
1 compromised version
- Sep 25, 2024
Malware in design-system-components-angular
1 compromised version
- Sep 25, 2024
Malware in internet-header
1 compromised version
- Sep 25, 2024
Malware in design-system-migrations
1 compromised version
- Sep 25, 2024
Malware in cktool.target.nodejs
1 compromised version
- Sep 25, 2024
Malware in com.sendbird.chat
1 compromised version
- Sep 25, 2024
Malware in quickstart-calls-chat-integration
1 compromised version
- Sep 25, 2024
Malware in sendbird-uikit-gpt
1 compromised version
- Sep 25, 2024
Malicious code in cktool.database (npm)
- Sep 25, 2024
Malware in ml-translate-vis
1 compromised version
- Sep 25, 2024
Malware in cktool.database
1 compromised version
- Sep 25, 2024
Malware in bce-service-bos-transport
1 compromised version
- Sep 25, 2024
Malware in bc-baseline
1 compromised version
- Sep 25, 2024
Malware in dotnet-runtime
1 compromised version
- Sep 25, 2024
Malware in eslint-config-b2b
1 compromised version
- Sep 25, 2024
Malware in bc-carousel
1 compromised version
- Sep 25, 2024
Malicious code in test-object-model (npm)
- Sep 25, 2024
Malware in test-object-model
1 compromised version
- Sep 25, 2024
Malware in minification
1 compromised version
- Sep 25, 2024
Malicious code in wpdesigndev.wp.agoda.com (npm)
3 compromised versions
- Sep 24, 2024
Malicious code in unguess-react (npm)
1 compromised version
- Sep 24, 2024
Malicious code in storj-docs (npm)
1 compromised version
- Sep 24, 2024
Malicious code in cgpt_burn_tracker_frontend (npm)
2 compromised versions
- Sep 24, 2024
Malicious code in meditek (npm)
2 compromised versions
- Sep 24, 2024
Malicious code in livingdesign-components (npm)
1 compromised version
- Sep 24, 2024
Malware in livingdesign-components
1 compromised version
- Sep 24, 2024
Malicious code in local-node-rig (npm)
- Sep 24, 2024
Malicious code in govuk-frontend-v4 (npm)
- Sep 24, 2024
Malware in govuk-frontend-v4
1 compromised version
- Sep 24, 2024
Malware in local-node-rig
1 compromised version
- Sep 24, 2024
Malware in infosnap-secure-family-portal
1 compromised version
Page 6094 of 6,646