Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Sep 24, 2024
Malware in snacks-design-system
1 compromised version
- Sep 23, 2024
Malicious code in missive-webhooks (npm)
1 compromised version
- Sep 23, 2024
Malicious code in tq-assignment-js (npm)
1 compromised version
- Sep 23, 2024
Malicious code in flow-multisig (npm)
1 compromised version
- Sep 23, 2024
Malicious code in dcnm-core (npm)
2 compromised versions
- Sep 23, 2024
Malicious code in node-request-ip (npm)
3 compromised versions
- Sep 23, 2024
Malware in node-request-ip
1 compromised version
- Sep 23, 2024
Malicious code in express-request-ip (npm)
- Sep 23, 2024
Malware in express-request-ip
1 compromised version
- Sep 23, 2024
Malware in randompackage-notreal
1 compromised version
- Sep 23, 2024
Malicious code in dotnet-runtime (npm)
1 compromised version
- Sep 22, 2024
Malicious code in labelv2 (npm)
1 compromised version
- Sep 22, 2024
Malicious code in ml-translate-vis (npm)
1 compromised version
- Sep 22, 2024
Malicious code in airwallex-platform-onboarding-sdk-demo-react (npm)
1 compromised version
- Sep 21, 2024
Malicious code in tannucolingboys (npm)
1 compromised version
- Sep 21, 2024
Malicious code in @the-df-company/commod (npm)
1 compromised version
- Sep 21, 2024
Malicious code in minification (npm)
1 compromised version
- Sep 21, 2024
Malicious code in @the-c-company/common-utils (npm)
1 compromised version
- Sep 21, 2024
Malicious code in linear-airbyte-source (npm)
2 compromised versions
- Sep 21, 2024
Malicious code in @the-c-company/scope_packages (npm)
1 compromised version
- Sep 21, 2024
Malicious code in smp-imsc (npm)
1 compromised version
- Sep 21, 2024
Malicious code in learning_npm1 (npm)
2 compromised versions
- Sep 21, 2024
Malicious code in bce-service-bos-transport (npm)
1 compromised version
- Sep 21, 2024
Malicious code in eslint-config-b2b (npm)
4 compromised versions
- Sep 20, 2024
Malicious code in randompackage-notreal (npm)
4 compromised versions
- Sep 20, 2024
Malicious code in cap1-application (npm)
1 compromised version
- Sep 20, 2024
Malicious code in vehicle-optionalproducts-ui (npm)
1 compromised version
- Sep 20, 2024
Malicious code in @energysolutions/mylib (npm)
10 compromised versions
- Sep 20, 2024
Malicious code in bc-carousel (npm)
5 compromised versions
- Sep 20, 2024
Malicious code in pring-payment-demo-backend (npm)
2 compromised versions
- Sep 20, 2024
Malicious code in basecontext (npm)
- Sep 20, 2024
Malware in basecontext
1 compromised version
- Sep 20, 2024
Malware in cst-web-chat
1 compromised version
- Sep 20, 2024
Malware in pring-payment-demo-backend
1 compromised version
- Sep 20, 2024
Malware in 0g-da-contract
1 compromised version
- Sep 20, 2024
Malicious code in npm-evil-fish (npm)
1 compromised version
- Sep 19, 2024
Malicious code in seconddjallal-ui-common (npm)
1 compromised version
- Sep 19, 2024
Malicious code in infosnap-secure-family-portal (npm)
1 compromised version
- Sep 19, 2024
Malicious code in confidential-package-name (npm)
1 compromised version
- Sep 19, 2024
Malicious code in dc-testing (npm)
1 compromised version
- Sep 19, 2024
Malicious code in shopify-app-session-storage-test-utils (npm)
1 compromised version
- Sep 19, 2024
Malicious code in princedecmtest (npm)
- Sep 19, 2024
Malicious code in myotherpkg (npm)
1 compromised version
- Sep 19, 2024
Malicious code in dmn-editor-envelope (npm)
1 compromised version
- Sep 19, 2024
Malicious code in bamoe-standalone-bpmn-and-dmn-editors-classic (npm)
- Sep 19, 2024
Malware in source-registry-storage-adapter
1 compromised version
- Sep 19, 2024
Malware in bamoe-standalone-bpmn-and-dmn-editors-classic
1 compromised version
- Sep 19, 2024
Malware in symphony-lib
1 compromised version
- Sep 19, 2024
Malware in rust-functions
1 compromised version
- Sep 19, 2024
Malware in shopify-app-session-storage-test-utils
1 compromised version
Page 6095 of 6,646