Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Sep 19, 2024
Malware in myotherpkg
1 compromised version
- Sep 19, 2024
Malware in ui-extensions-test-utils
1 compromised version
- Sep 19, 2024
Malware in events_pkg
1 compromised version
- Sep 19, 2024
Malware in princedecmtest
1 compromised version
- Sep 19, 2024
Malware in dmn-editor-envelope
1 compromised version
- Sep 19, 2024
Malware in bamoe-standalone-dmn-editor
1 compromised version
- Sep 19, 2024
Malicious code in mfp-config-xml (npm)
1 compromised version
- Sep 19, 2024
Malicious code in ibm-strings (npm)
1 compromised version
- Sep 19, 2024
Malware in mfp-config-xml
1 compromised version
- Sep 19, 2024
Malware in ibm-strings
1 compromised version
- Sep 18, 2024
Malware in stedi-integrations
1 compromised version
- Sep 18, 2024
Malicious code in zama1.js (npm)
1 compromised version
- Sep 18, 2024
Malicious code in zama.js (npm)
- Sep 18, 2024
Malicious code in ttuiooty (npm)
1 compromised version
- Sep 18, 2024
Malicious code in trjhasd (npm)
- Sep 18, 2024
Malicious code in rokihfds (npm)
- Sep 18, 2024
Malicious code in rnjnioep (npm)
- Sep 18, 2024
Malicious code in kk4845.js (npm)
1 compromised version
- Sep 18, 2024
Malware in ttuiooty
1 compromised version
- Sep 18, 2024
Malware in rokihfds
1 compromised version
- Sep 18, 2024
Malware in kk4845.js
1 compromised version
- Sep 18, 2024
Malware in zama1.js
1 compromised version
- Sep 18, 2024
Malware in trjhasd
1 compromised version
- Sep 18, 2024
Malware in rnjnioep
1 compromised version
- Sep 18, 2024
Malware in zama.js
1 compromised version
- Sep 18, 2024
Malicious code in evm-oracle (npm)
- Sep 18, 2024
Malware in evm-oracle
1 compromised version
- Sep 18, 2024
Malicious code in temp928546 (npm)
- Sep 18, 2024
Malicious code in temp240824 (npm)
- Sep 18, 2024
Malware in temp928546
1 compromised version
- Sep 18, 2024
Malware in temp240824
1 compromised version
- Sep 18, 2024
Malicious code in bsc-stdlib-polyfill (npm)
1 compromised version
- Sep 18, 2024
Malicious code in acronym-decoder-chrome-angular (npm)
1 compromised version
- Sep 18, 2024
Malicious code in grv-teleport (npm)
1 compromised version
- Sep 18, 2024
Malicious code in onfido-web-sdk-angular (npm)
1 compromised version
- Sep 18, 2024
Malicious code in huehue (npm)
1 compromised version
- Sep 18, 2024
Malicious code in bamoe-standalone-dmn-editor (npm)
1 compromised version
- Sep 18, 2024
Malicious code in insidepocpackage (npm)
2 compromised versions
- Sep 18, 2024
Malware in insidepocpackage
1 compromised version
- Sep 17, 2024
Malicious code in bby-node-logger (npm)
2 compromised versions
- Sep 17, 2024
Malicious code in ui-extensions-test-utils (npm)
1 compromised version
- Sep 17, 2024
Malicious code in 0g-da-contract (npm)
1 compromised version
- Sep 17, 2024
Malicious code in stedi-integrations (npm)
2 compromised versions
- Sep 17, 2024
Malicious code in cobainsendiri1 (npm)
1 compromised version
- Sep 17, 2024
Malicious code in wallet-balance-notifier (npm)
1 compromised version
- Sep 17, 2024
Malicious code in stripe-testfb-v3 (npm)
- Sep 17, 2024
Malware in stripe-testfb-v3
1 compromised version
- Sep 17, 2024
Malicious code in ably-sales-demo-frontend (npm)
- Sep 17, 2024
Malicious code in ably-engineering (npm)
- Sep 17, 2024
Malware in ably-engineering
1 compromised version
Page 6096 of 6,646