Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,278 total in npm · sorted newest first- Aug 7, 2024
Malicious code in weather-git-premium (npm)
- Aug 7, 2024
Malicious code in waffles-tokens (npm)
- Aug 7, 2024
Malicious code in uitk-react-scrollable (npm)
- Aug 7, 2024
Malicious code in uitk-react-experimental-button-tabs (npm)
- Aug 7, 2024
Malicious code in uitk-react-date-selector (npm)
- Aug 7, 2024
Malicious code in uitk-react-calendar (npm)
- Aug 7, 2024
Malicious code in test12356666 (npm)
- Aug 7, 2024
Malicious code in taap-package-rates (npm)
- Aug 7, 2024
Malicious code in taap-context (npm)
- Aug 7, 2024
Malicious code in taap-bernie-plugin-pendo (npm)
- Aug 7, 2024
Malicious code in syf-multi-account-dashboard (npm)
- Aug 7, 2024
Malicious code in syf-component-library (npm)
- Aug 7, 2024
Malicious code in statements-mfe (npm)
- Aug 7, 2024
Malicious code in rewards-mfe (npm)
- Aug 7, 2024
Malicious code in resumecom-validations (npm)
- Aug 7, 2024
Malicious code in react-hook-form-7 (npm)
- Aug 7, 2024
Malicious code in orion-all-6.0.2 (npm)
- Aug 7, 2024
Malicious code in new-relic-browser (npm)
- Aug 7, 2024
Malicious code in module-utils (npm)
- Aug 7, 2024
Malicious code in make-a-payment (npm)
- Aug 7, 2024
Malicious code in localization-configuration (npm)
- Aug 7, 2024
Malicious code in legacy-swc-helpers (npm)
- Aug 7, 2024
Malicious code in kaleido-event-tracker (npm)
- Aug 7, 2024
Malicious code in interpolation.js (npm)
- Aug 7, 2024
Malicious code in gutenberg-ui (npm)
- Aug 7, 2024
Malicious code in frontend-static-props-provider (npm)
- Aug 7, 2024
Malicious code in free-bets-list (npm)
- Aug 7, 2024
Malicious code in ember-unified-navbar-360 (npm)
- Aug 7, 2024
Malicious code in egds-tools (npm)
- Aug 7, 2024
Malicious code in dx-virtual-assistent-sdk (npm)
- Aug 7, 2024
Malicious code in dx-feedback-utils (npm)
- Aug 7, 2024
Malicious code in dx-event-tracker (npm)
- Aug 7, 2024
Malicious code in dk-verification (npm)
- Aug 7, 2024
Malicious code in desttestdsfasdfsdsds (npm)
- Aug 7, 2024
Malicious code in dataminr-ui (npm)
- Aug 7, 2024
Malicious code in customer-oauth2-token-management-utility (npm)
- Aug 7, 2024
Malicious code in bernie-plugin-controllers (npm)
- Aug 7, 2024
Malicious code in bernie-plugin-affiliate-context (npm)
- Aug 7, 2024
Malicious code in bankrate-stuff (npm)
- Aug 7, 2024
Malicious code in bankrate-iconographyz (npm)
- Aug 7, 2024
Malicious code in bankrate-iconographynope (npm)
- Aug 7, 2024
Malicious code in bankrate-iconographyasda (npm)
- Aug 7, 2024
Malicious code in bankrate-iconography1 (npm)
- Aug 7, 2024
Malicious code in bankrate-htr (npm)
- Aug 7, 2024
Malicious code in babel-preset-sofi-scripts (npm)
- Aug 7, 2024
Malicious code in authorization-module (npm)
- Aug 7, 2024
Malicious code in asdfasdfasdfsdfasfsd (npm)
- Aug 7, 2024
Malicious code in ampersend-mymove (npm)
- Aug 7, 2024
Malicious code in alerts-mfe (npm)
- Aug 7, 2024
Malicious code in affirm-requests (npm)
Page 6131 of 6,646