Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,278 total in npm · sorted newest first- Aug 7, 2024
Malicious code in advertising-api-javascript-client (npm)
- Aug 7, 2024
Malicious code in adsfasdfadsfasdfasdfasdfsd (npm)
- Aug 7, 2024
Malicious code in @incisive/rvtestmodule (npm)
- Aug 7, 2024
Malware in frontend-static-props-provider
1 compromised version
- Aug 7, 2024
Malware in taap-context
1 compromised version
- Aug 7, 2024
Malware in statements-mfe
1 compromised version
- Aug 7, 2024
Malware in syf-multi-account-dashboard
1 compromised version
- Aug 7, 2024
Malware in bankrate-htr
1 compromised version
- Aug 7, 2024
Malware in taap-bernie-plugin-pendo
1 compromised version
- Aug 7, 2024
Malware in uitk-react-date-selector
1 compromised version
- Aug 7, 2024
Malware in dk-verification
1 compromised version
- Aug 7, 2024
Malware in test12356666
1 compromised version
- Aug 7, 2024
Malware in syf-component-library
1 compromised version
- Aug 7, 2024
Malware in asdfasdfasdfsdfasfsd
1 compromised version
- Aug 7, 2024
Malware in bernie-plugin-controllers
1 compromised version
- Aug 7, 2024
Malware in uitk-react-scrollable
1 compromised version
- Aug 7, 2024
Malware in interpolation.js
1 compromised version
- Aug 7, 2024
Malware in waffles-tokens
1 compromised version
- Aug 7, 2024
Malware in alerts-mfe
1 compromised version
- Aug 7, 2024
Malware in bankrate-iconographyz
1 compromised version
- Aug 7, 2024
Malware in bankrate-stuff
1 compromised version
- Aug 7, 2024
Malware in dx-event-tracker
1 compromised version
- Aug 7, 2024
Malware in bernie-plugin-affiliate-context
1 compromised version
- Aug 7, 2024
Malware in weather-git-premium
1 compromised version
- Aug 7, 2024
Malware in react-hook-form-7
1 compromised version
- Aug 7, 2024
Malware in uitk-react-experimental-button-tabs
1 compromised version
- Aug 7, 2024
Malware in free-bets-list
1 compromised version
- Aug 7, 2024
Malware in module-utils
1 compromised version
- Aug 7, 2024
Malware in gutenberg-ui
1 compromised version
- Aug 7, 2024
Malware in adsfasdfadsfasdfasdfasdfsd
1 compromised version
- Aug 7, 2024
Malware in bankrate-iconographynope
1 compromised version
- Aug 7, 2024
Malware in taap-package-rates
1 compromised version
- Aug 7, 2024
Malware in uitk-react-calendar
1 compromised version
- Aug 7, 2024
Malware in dx-virtual-assistent-sdk
1 compromised version
- Aug 7, 2024
Malware in resumecom-validations
1 compromised version
- Aug 7, 2024
Malware in legacy-swc-helpers
1 compromised version
- Aug 7, 2024
Malware in authorization-module
1 compromised version
- Aug 7, 2024
Malware in customer-oauth2-token-management-utility
1 compromised version
- Aug 7, 2024
Malware in bankrate-iconography1
1 compromised version
- Aug 7, 2024
Malware in localization-configuration
1 compromised version
- Aug 7, 2024
Malware in new-relic-browser
1 compromised version
- Aug 7, 2024
Malware in babel-preset-sofi-scripts
1 compromised version
- Aug 7, 2024
Malware in desttestdsfasdfsdsds
1 compromised version
- Aug 7, 2024
Malware in orion-all-6.0.2
1 compromised version
- Aug 7, 2024
Malware in @incisive/rvtestmodule
1 compromised version
- Aug 7, 2024
Malware in rewards-mfe
1 compromised version
- Aug 7, 2024
Malware in bankrate-iconographyasda
1 compromised version
- Aug 7, 2024
Malware in dataminr-ui
1 compromised version
- Aug 7, 2024
Malware in ampersend-mymove
1 compromised version
- Aug 7, 2024
Malware in wistia_namespace.js
1 compromised version
Page 6132 of 6,646