Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,288 total in npm · sorted newest first- Sep 4, 2024
Malicious code in kahoot-wp (npm)
1 compromised version
- Sep 4, 2024
Malicious code in enews (npm)
2 compromised versions
- Sep 4, 2024
Malicious code in cap-client-app (npm)
1 compromised version
- Sep 4, 2024
Malicious code in bss.bssadmin-fe (npm)
1 compromised version
- Sep 4, 2024
Malware in bss.bssadmin-fe
1 compromised version
- Sep 4, 2024
Malware in kahoot-wp
1 compromised version
- Sep 4, 2024
Malware in enews
1 compromised version
- Sep 4, 2024
Malware in cap-client-app
1 compromised version
- Sep 4, 2024
Malicious code in wif-bitcoin (npm)
- Sep 4, 2024
Malicious code in qr-image-generator (npm)
- Sep 4, 2024
Malicious code in litecoin-address-validator (npm)
- Sep 4, 2024
Malicious code in dogecoin-address-validator (npm)
- Sep 4, 2024
Malicious code in crypto-dbc (npm)
- Sep 4, 2024
Malicious code in bitcoin-sign-message (npm)
- Sep 4, 2024
Malicious code in bitcoin-sign (npm)
- Sep 4, 2024
Malicious code in bitcoin-message (npm)
- Sep 4, 2024
Malicious code in bitcoin-address-validator (npm)
- Sep 4, 2024
Malicious code in b39zz (npm)
- Sep 4, 2024
Malware in litecoin-address-validator
1 compromised version
- Sep 4, 2024
Malware in bitcoin-address-validator
1 compromised version
- Sep 4, 2024
Malware in bitcoin-message
1 compromised version
- Sep 4, 2024
Malware in bitcoin-sign
1 compromised version
- Sep 4, 2024
Malware in bitcoin-sign-message
1 compromised version
- Sep 4, 2024
Malware in crypto-dbc
1 compromised version
- Sep 4, 2024
Malware in wif-bitcoin
1 compromised version
- Sep 4, 2024
Malware in qr-image-generator
1 compromised version
- Sep 4, 2024
Malware in b39zz
1 compromised version
- Sep 4, 2024
Malware in dogecoin-address-validator
1 compromised version
- Sep 4, 2024
Malicious code in nginerrer-web-shell (npm)
10 compromised versions
- Sep 4, 2024
Malware in nginerrer-web-shell
1 compromised version
- Sep 4, 2024
Malicious code in noierrdev-web3-shell (npm)
3 compromised versions
- Sep 4, 2024
Malware in noierrdev-web3-shell
1 compromised version
- Sep 4, 2024
Malicious code in my-css-package (npm)
- Sep 4, 2024
Malware in my-css-package
1 compromised version
- Sep 4, 2024
Malicious code in grand_xss (npm)
8 compromised versions
- Sep 4, 2024
Malware in grand_xss
1 compromised version
- Sep 4, 2024
Malicious code in td-emerald-standards (npm)
1 compromised version
- Sep 4, 2024
Malicious code in afe-base-component (npm)
1 compromised version
- Sep 3, 2024
Malicious code in e2e-testa (npm)
1 compromised version
- Sep 3, 2024
Malicious code in @google-research/retvecjs (npm)
2 compromised versions
- Sep 3, 2024
Malicious code in ywoeuwe (npm)
1 compromised version
- Sep 3, 2024
Malicious code in nspwieo (npm)
1 compromised version
- Sep 3, 2024
Malicious code in hwieiur (npm)
1 compromised version
- Sep 3, 2024
Malicious code in esdjiw (npm)
1 compromised version
- Sep 3, 2024
Malicious code in mhnumjp (npm)
1 compromised version
- Sep 3, 2024
Malicious code in dowload_ebok_todas_as_sextas_by_paola_carosella_uz4x6 (npm)
- MAL-2024-8713Malwarenpmdowload_ebok_il_codice_wildix_la_vera_storia_del_centralino_b_by_emiliano_tomasoni_laura_piaz_p70e8Sep 3, 2024
Malicious code in dowload_ebok_il_codice_wildix_la_vera_storia_del_centralino_b_by_emiliano_tomasoni_laura_piaz_p70e8 (npm)
- Sep 3, 2024
Malicious code in dowload_ebok_farouche_atalante_by_emilie_druilhe_nx2bj (npm)
- Sep 3, 2024
Malicious code in dowload_ebok_everything_in_between_a_rocker_romance_by_melissa_toppen_fp7ge (npm)
- Sep 3, 2024
Malware in dowload_ebok_farouche_atalante_by_emilie_druilhe_nx2bj
1 compromised version
Page 6102 of 6,646