Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Sep 10, 2024
Malware in cryptograph-js
1 compromised version
- Sep 10, 2024
Malicious code in priv-pack (npm)
1 compromised version
- Sep 10, 2024
Malware in apigeeclientlib
1 compromised version
- Sep 10, 2024
Malware in roblox-badges
1 compromised version
- Sep 10, 2024
Malicious code in roblox-tracer (npm)
2 compromised versions
- Sep 10, 2024
Malware in roblox-tracer
1 compromised version
- Sep 10, 2024
Malware in core-roblox-utilities
1 compromised version
- Sep 10, 2024
Malware in roblox-event-tracker
1 compromised version
- Sep 9, 2024
Malware in ethersscan-api
1 compromised version
- Sep 9, 2024
Malware in eslint-scope-util
1 compromised version
- Sep 9, 2024
Malware in eslint-module-conf
1 compromised version
- Sep 9, 2024
Malicious code in ultimiort (npm)
- Sep 9, 2024
Malicious code in gapuler (npm)
- Sep 9, 2024
Malware in gapuler
1 compromised version
- Sep 9, 2024
Malware in ultimiort
1 compromised version
- Sep 9, 2024
Malware in vrt_hitlijst_generic_voting
1 compromised version
- Sep 9, 2024
Malicious code in evolution-ds (npm)
2 compromised versions
- Sep 9, 2024
Malware in evolution-ds
1 compromised version
- Sep 9, 2024
Malware in 0g-storage-contracts
1 compromised version
- Sep 9, 2024
Malicious code in roblox-badges (npm)
2 compromised versions
- Sep 9, 2024
Malicious code in roblox-event-tracker (npm)
3 compromised versions
- Sep 9, 2024
Malicious code in core-roblox-utilities (npm)
2 compromised versions
- Sep 9, 2024
Malicious code in azure-iothub-service-client (npm)
2 compromised versions
- Sep 9, 2024
Malicious code in video.min (npm)
10 compromised versions
- Sep 9, 2024
Malicious code in balvant-chavda (npm)
5 compromised versions
- Sep 8, 2024
Malicious code in @rev-mfe-temporary/notifications (npm)
1 compromised version
- Sep 8, 2024
Malicious code in @pd-mfe/framework-request-context (npm)
1 compromised version
- Sep 8, 2024
Malicious code in @sky-team/create-project-modal (npm)
1 compromised version
- Sep 8, 2024
Malicious code in @zarafront/lib-zds (npm)
1 compromised version
- Sep 8, 2024
Malicious code in @warnermediacode/wme-theme-gelatam (npm)
1 compromised version
- Sep 8, 2024
Malicious code in @warnermediacode/wme-gep-modules-bundle (npm)
1 compromised version
- Sep 8, 2024
Malicious code in mobileye-8-connect (npm)
1 compromised version
- Sep 8, 2024
Malicious code in ori-poc (npm)
2 compromised versions
- Sep 8, 2024
Malicious code in ori-gabriel-rce-test (npm)
4 compromised versions
- Sep 8, 2024
Malicious code in ori-gabriel-test2 (npm)
1 compromised version
- Sep 8, 2024
Malicious code in ori-gabriel-test (npm)
1 compromised version
- Sep 7, 2024
Malicious code in skibo (npm)
1 compromised version
- Sep 7, 2024
Malicious code in ioiwds (npm)
1 compromised version
- Sep 7, 2024
Malicious code in iojds (npm)
1 compromised version
- Sep 7, 2024
Malicious code in ethersscan-api (npm)
4 compromised versions
- Sep 7, 2024
Malicious code in eslint-scope-util (npm)
2 compromised versions
- Sep 7, 2024
Malicious code in eslint-module-conf (npm)
2 compromised versions
- Sep 6, 2024
Malicious code in snacks-design-system (npm)
2 compromised versions
- Sep 6, 2024
Malicious code in vpro-dhhvc (npm)
2 compromised versions
- Sep 6, 2024
Malicious code in tappp-tv-ui-libs (npm)
1 compromised version
- Sep 6, 2024
Malware in tappp-tv-ui-lib
1 compromised version
- Sep 6, 2024
Malware in tappp-tv-ui-libs
1 compromised version
- Sep 6, 2024
Malicious code in indrive-web (npm)
2 compromised versions
- Sep 6, 2024
Malware in indrive-web
1 compromised version
- Sep 5, 2024
Malicious code in apigeeclientlib (npm)
2 compromised versions
Page 6098 of 6,646