Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,278 total in npm · sorted newest first- Sep 2, 2024
Malicious code in @diotoborg/aliquid-quae-dicta (npm)
- Sep 2, 2024
Malicious code in @diotoborg/aliquam-sit-sed (npm)
- Sep 2, 2024
Malware in @diotoborg/necessitatibus-voluptas-iusto
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/est-voluptate
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/placeat-placeat
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/fuga-sequi
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/illo-placeat
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/vero-eligendi-deleniti
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/aliquam-sit-sed
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/vel-labore-incidunt
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/consequuntur-dolorem-dicta
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/dicta-recusandae-veniam
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/quo-neque
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/non-reiciendis
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/illum-ad-corporis
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/eum-tempora-distinctio
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/dolor-iure
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/aliquid-quae-dicta
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/verbose-robot
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/dolor-earum-quia
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/quis-fugit-possimus
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/velit-placeat
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/dolorem-possimus
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/quia-eaque-molestiae
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/necessitatibus-nam-tempora
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/provident-accusamus
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/ex-repellat
1 compromised version
- Sep 2, 2024
Malicious code in @diotoborg/nulla-optio (npm)
- Sep 2, 2024
Malicious code in @diotoborg/deleniti-adipisci (npm)
- Sep 2, 2024
Malware in @diotoborg/deleniti-adipisci
1 compromised version
- Sep 2, 2024
Malware in @diotoborg/nulla-optio
1 compromised version
- Aug 30, 2024
Malicious code in investitsionnaia-platforma-finam-p2p-zil8cb0ii (npm)
- Aug 30, 2024
Malware in investitsionnaia-platforma-finam-p2p-zil8cb0ii
1 compromised version
- Aug 30, 2024
Malicious code in kak-kupit-kriptovaliutu-v-rossii-cherez-tinkoff-investitsii-s21dt6n0d (npm)
- Aug 30, 2024
Malware in kak-kupit-kriptovaliutu-v-rossii-cherez-tinkoff-investitsii-s21dt6n0d
1 compromised version
- Aug 30, 2024
Malicious code in sniper302 (npm)
- Aug 30, 2024
Malicious code in copilot-web-widgets (npm)
1 compromised version
- Aug 30, 2024
Malware in copilot-web-widgets
1 compromised version
- Aug 30, 2024
Malware in sniper302
1 compromised version
- Aug 29, 2024
Malicious code in jest-preset-halo (npm)
2 compromised versions
- Aug 29, 2024
Malicious code in dwt-runner (npm)
2 compromised versions
- Aug 29, 2024
Malware in jest-preset-halo
1 compromised version
- Aug 29, 2024
Malware in dwt-runner
1 compromised version
- Aug 29, 2024
Malicious code in xhjxhjmilo (npm)
1 compromised version
- Aug 29, 2024
Malicious code in open-wuji-lib (npm)
2 compromised versions
- Aug 29, 2024
Malicious code in mp-template (npm)
1 compromised version
- Aug 29, 2024
Malicious code in milowebsdk (npm)
3 compromised versions
- Aug 29, 2024
Malicious code in milosdk (npm)
1 compromised version
- Aug 29, 2024
Malicious code in milominisdk (npm)
4 compromised versions
- Aug 29, 2024
Malicious code in milo_next (npm)
2 compromised versions
Page 6127 of 6,646