Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,278 total in npm · sorted newest first- Aug 26, 2024
Malware in eslint-config-react-web
1 compromised version
- Aug 26, 2024
Malware in cargo-hub-ui-api
1 compromised version
- Aug 26, 2024
Malware in cargo-hub-ui-api-internal
1 compromised version
- Aug 26, 2024
Malware in benasin_logger
1 compromised version
- Aug 26, 2024
Malware in @pgc-web/web-creation
1 compromised version
- Aug 26, 2024
Malware in @live-backstage/client
1 compromised version
- Aug 26, 2024
Malware in radioplayer
1 compromised version
- Aug 26, 2024
Malware in twentytwentyone
1 compromised version
- Aug 26, 2024
Malicious code in solana-cctp-contracts (npm)
1 compromised version
- Aug 26, 2024
Malware in solana-cctp-contracts
1 compromised version
- Aug 26, 2024
Malicious code in system-library-gameanalytics-slotanalytics (npm)
- Aug 26, 2024
Malicious code in system-library-gameanalytics-common (npm)
- Aug 26, 2024
Malicious code in system-library-gameanalytics-client (npm)
- Aug 26, 2024
Malicious code in platform-client-messaging-service (npm)
- Aug 26, 2024
Malicious code in @benasin_2/frontend-logger (npm)
- Aug 26, 2024
Malware in system-library-gameanalytics-common
1 compromised version
- Aug 26, 2024
Malware in system-library-gameanalytics-client
1 compromised version
- Aug 26, 2024
Malware in platform-client-messaging-service
1 compromised version
- Aug 26, 2024
Malware in system-library-gameanalytics-slotanalytics
1 compromised version
- Aug 26, 2024
Malware in @benasin_2/frontend-logger
1 compromised version
- Aug 26, 2024
Malware in cchome-shared
1 compromised version
- Aug 26, 2024
Malicious code in @pampa-ui/pill (npm)
- Aug 26, 2024
Malware in @pampa-ui/pill
1 compromised version
- Aug 12, 2024
Malicious code in cchome-shared (npm)
1 compromised version
- Aug 11, 2024
Malicious code in cargo-hub-ui-api (npm)
1 compromised version
- Aug 11, 2024
Malicious code in cargo-hub-ui-api-internal (npm)
1 compromised version
- Aug 11, 2024
Malicious code in @live-backstage/client (npm)
1 compromised version
- Aug 11, 2024
Malicious code in @pgc-web/web-creation (npm)
2 compromised versions
- Aug 10, 2024
Malicious code in radioplayer (npm)
1 compromised version
- Aug 9, 2024
Malicious code in postman-open-technologies-knowledge-base-api (npm)
1 compromised version
- Aug 9, 2024
Malicious code in benasin_logger (npm)
1 compromised version
- Aug 9, 2024
Malware in @adidas-data-mesh/consumer-journey
1 compromised version
- Aug 9, 2024
Malware in @adidas-data-mesh/common
1 compromised version
- Aug 9, 2024
Malware in @adidas-data-mesh/common-aws
1 compromised version
- Aug 9, 2024
Malicious code in @avaldigitallabs/adl-pfm-lib-web-components (npm)
- Aug 9, 2024
Malware in @avaldigitallabs/adl-pfm-lib-web-components
1 compromised version
- Aug 8, 2024
Malicious code in internal-corp (npm)
1 compromised version
- Aug 7, 2024
Malicious code in syf-js-utilities (npm)
- Aug 7, 2024
Malicious code in mma-mfe (npm)
- Aug 7, 2024
Malicious code in iva-react-web-ui (npm)
- Aug 7, 2024
Malicious code in incisive_testing_stufff (npm)
- Aug 7, 2024
Malicious code in desttest (npm)
- Aug 7, 2024
Malicious code in click-action-framework (npm)
- Aug 7, 2024
Malware in syf-js-utilities
1 compromised version
- Aug 7, 2024
Malware in desttest
1 compromised version
- Aug 7, 2024
Malware in click-action-framework
1 compromised version
- Aug 7, 2024
Malware in incisive_testing_stufff
1 compromised version
- Aug 7, 2024
Malware in mma-mfe
1 compromised version
- Aug 7, 2024
Malware in iva-react-web-ui
1 compromised version
- Aug 7, 2024
Malicious code in wistia_namespace.js (npm)
Page 6130 of 6,646