Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Sep 5, 2024
Malicious code in tappp-tv-ui-lib (npm)
1 compromised version
- Sep 5, 2024
Malicious code in testcafe-reporter-ayx-reportportal (npm)
2 compromised versions
- Sep 5, 2024
Malicious code in 0g-storage-contracts (npm)
2 compromised versions
- Sep 5, 2024
Malicious code in harthat-hash (npm)
1 compromised version
- Sep 5, 2024
Malicious code in harthat-api (npm)
1 compromised version
- Sep 5, 2024
Malicious code in call-blockflow (npm)
1 compromised version
- Sep 5, 2024
Malicious code in tcgplayer-developer (npm)
2 compromised versions
- Sep 5, 2024
Malware in tcgplayer-developer
1 compromised version
- Sep 5, 2024
Malicious code in sigma-errors (npm)
- Sep 5, 2024
Malicious code in hyperion-global (npm)
- Sep 5, 2024
Malicious code in cui-i18n-coke (npm)
- Sep 5, 2024
Malicious code in com.meta.xrpa (npm)
- Sep 5, 2024
Malware in com.meta.xrpa
1 compromised version
- Sep 5, 2024
Malware in hyperion-global
1 compromised version
- Sep 5, 2024
Malware in cui-i18n-coke
1 compromised version
- Sep 5, 2024
Malware in sigma-errors
1 compromised version
- Sep 5, 2024
Malicious code in videoads-util-capability-detection (npm)
- Sep 5, 2024
Malware in videoads-util-capability-detection
1 compromised version
- Sep 4, 2024
Malicious code in @maas-tools/module-federations (npm)
7 compromised versions
- Sep 4, 2024
Malicious code in @maas-themes/eslint-config-react-typescript (npm)
1 compromised version
- Sep 4, 2024
Malicious code in @maas-themes/config (npm)
1 compromised version
- Sep 4, 2024
Malicious code in @maas-tools/keycloak (npm)
3 compromised versions
- Sep 4, 2024
Malicious code in @maas-tools/nested-browser-router (npm)
2 compromised versions
- Sep 4, 2024
Malicious code in @maas-tools/accounts (npm)
3 compromised versions
- Sep 4, 2024
Malicious code in @desesap289/dev_dependency (npm)
1 compromised version
- Sep 4, 2024
Malicious code in @ep-mobile/icons (npm)
1 compromised version
- Sep 4, 2024
Malicious code in walletv5 (npm)
1 compromised version
- Sep 4, 2024
Malicious code in dither-client (npm)
1 compromised version
- Sep 4, 2024
Malware in dither-client
1 compromised version
- Sep 4, 2024
Malware in walletv5
1 compromised version
- Sep 4, 2024
Malicious code in saptiya (npm)
14 compromised versions
- Sep 4, 2024
Malicious code in rbds-frill-auth0-integration (npm)
1 compromised version
- Sep 4, 2024
Malware in rbds-frill-auth0-integration
1 compromised version
- Sep 4, 2024
Malware in saptiya
1 compromised version
- Sep 4, 2024
Malicious code in xwuirit (npm)
- Sep 4, 2024
Malicious code in xiwoeir (npm)
1 compromised version
- Sep 4, 2024
Malicious code in vueoriu (npm)
1 compromised version
- Sep 4, 2024
Malicious code in swioeur (npm)
1 compromised version
- Sep 4, 2024
Malicious code in nwoeuot (npm)
- Sep 4, 2024
Malicious code in lowieore (npm)
1 compromised version
- Sep 4, 2024
Malicious code in hwueoir (npm)
1 compromised version
- Sep 4, 2024
Malicious code in hwpoepr (npm)
1 compromised version
- Sep 4, 2024
Malicious code in hwieuor (npm)
1 compromised version
- Sep 4, 2024
Malicious code in gswoer (npm)
1 compromised version
- Sep 4, 2024
Malicious code in dwieuor (npm)
1 compromised version
- Sep 4, 2024
Malicious code in bwoeuow (npm)
- Sep 4, 2024
Malicious code in anieort (npm)
1 compromised version
- Sep 4, 2024
Malware in anieort
1 compromised version
- Sep 4, 2024
Malware in hwpoepr
1 compromised version
- Sep 4, 2024
Malware in bwoeuow
1 compromised version
Page 6099 of 6,646