Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,278 total in npm · sorted newest first- Aug 28, 2024
Malware in who_mobile
1 compromised version
- Aug 28, 2024
Malicious code in www-cloudcarbonfootprint-org (npm)
- Aug 28, 2024
Malicious code in root-template (npm)
- Aug 28, 2024
Malicious code in lodash-scripts (npm)
- Aug 28, 2024
Malware in root-template
1 compromised version
- Aug 28, 2024
Malware in lodash-scripts
1 compromised version
- Aug 28, 2024
Malware in www-cloudcarbonfootprint-org
1 compromised version
- Aug 28, 2024
Malicious code in @point-frontend-library/oc-skeleton (npm)
1 compromised version
- Aug 28, 2024
Malware in @point-frontend-library/oc-skeleton
1 compromised version
- Aug 28, 2024
Malicious code in @mp-ss-promotions-lib/components (npm)
1 compromised version
- Aug 28, 2024
Malicious code in @isp-frontend-library/melidata (npm)
2 compromised versions
- Aug 28, 2024
Malware in @isp-frontend-library/melidata
1 compromised version
- Aug 28, 2024
Malware in @mp-ss-promotions-lib/components
1 compromised version
- Aug 28, 2024
Malicious code in @costs-components-ui/costs (npm)
1 compromised version
- Aug 28, 2024
Malware in @costs-components-ui/costs
1 compromised version
- Aug 28, 2024
Malicious code in skippr (npm)
- Aug 28, 2024
Malicious code in nodejs-docs-samples-vision (npm)
- Aug 28, 2024
Malicious code in dependency-confusion-example (npm)
5 compromised versions
- Aug 28, 2024
Malware in dependency-confusion-example
1 compromised version
- Aug 28, 2024
Malware in nodejs-docs-samples-vision
1 compromised version
- Aug 28, 2024
Malware in skippr
1 compromised version
- Aug 28, 2024
Malicious code in side-view (npm)
1 compromised version
- Aug 28, 2024
Malicious code in fxa (npm)
- Aug 28, 2024
Malware in fxa
1 compromised version
- Aug 28, 2024
Malware in side-view
1 compromised version
- Aug 27, 2024
Malicious code in telegram-con (npm)
- Aug 27, 2024
Malicious code in helmet-validate (npm)
- Aug 27, 2024
Malware in helmet-validate
1 compromised version
- Aug 27, 2024
Malware in telegram-con
1 compromised version
- Aug 26, 2024
Malicious code in glitchverse (npm)
- Aug 26, 2024
Malicious code in glitchhub (npm)
- Aug 26, 2024
Malicious code in glitchgoat (npm)
- Aug 26, 2024
Malware in glitchverse
1 compromised version
- Aug 26, 2024
Malware in glitchhub
1 compromised version
- Aug 26, 2024
Malware in glitchgoat
1 compromised version
- Aug 26, 2024
Malicious code in digital-experience (npm)
- Aug 26, 2024
Malware in digital-experience
1 compromised version
- Aug 26, 2024
Malicious code in @digital-experience/test (npm)
- Aug 26, 2024
Malicious code in @digital-experience/product (npm)
- Aug 26, 2024
Malware in @digital-experience/test
1 compromised version
- Aug 26, 2024
Malware in @digital-experience/product
1 compromised version
- Aug 26, 2024
Malware in ember-addon-cache-util
1 compromised version
- Aug 26, 2024
Malware in recovery-center-web-sdk
1 compromised version
- Aug 26, 2024
Malicious code in uip-scripts (npm)
1 compromised version
- Aug 26, 2024
Malicious code in tsconfig-react-web (npm)
1 compromised version
- Aug 26, 2024
Malicious code in prettier-config-react (npm)
1 compromised version
- Aug 26, 2024
Malicious code in eslint-config-react-web (npm)
2 compromised versions
- Aug 26, 2024
Malware in tsconfig-react-web
1 compromised version
- Aug 26, 2024
Malware in prettier-config-react
1 compromised version
- Aug 26, 2024
Malware in uip-scripts
1 compromised version
Page 6129 of 6,646