Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,278 total in npm · sorted newest first- Aug 7, 2024
Malicious code in towieur (npm)
- Aug 7, 2024
Malicious code in teiwosjd (npm)
- Aug 7, 2024
Malicious code in ooflienro (npm)
- Aug 7, 2024
Malicious code in nioskdue (npm)
- Aug 7, 2024
Malicious code in kiwoeslw (npm)
- Aug 7, 2024
Malicious code in jiworis (npm)
- Aug 7, 2024
Malicious code in hioesjri (npm)
- Aug 7, 2024
Malicious code in gilbriatedir (npm)
- Aug 7, 2024
Malicious code in fieorusls (npm)
- Aug 7, 2024
Malware in ooflienro
1 compromised version
- Aug 7, 2024
Malware in kiwoeslw
1 compromised version
- Aug 7, 2024
Malware in woodiorers
1 compromised version
- Aug 7, 2024
Malware in gilbriatedir
1 compromised version
- Aug 7, 2024
Malware in towieur
1 compromised version
- Aug 7, 2024
Malware in hioesjri
1 compromised version
- Aug 7, 2024
Malware in fieorusls
1 compromised version
- Aug 7, 2024
Malware in jiworis
1 compromised version
- Aug 7, 2024
Malware in uewopdn
1 compromised version
- Aug 7, 2024
Malware in teiwosjd
1 compromised version
- Aug 7, 2024
Malware in nioskdue
1 compromised version
- Aug 7, 2024
Malware in yuriosid
1 compromised version
- Aug 7, 2024
Malicious code in igen-ui (npm)
1 compromised version
- Aug 7, 2024
Malicious code in @adidas-data-mesh/consumer-journey (npm)
1 compromised version
- Aug 7, 2024
Malicious code in @adidas-data-mesh/common (npm)
1 compromised version
- Aug 7, 2024
Malicious code in tsc-aws-s3 (npm)
1 compromised version
- Aug 7, 2024
Malicious code in mapbox-maps-android (npm)
- Aug 7, 2024
Malicious code in fabricexample (npm)
- Aug 7, 2024
Malware in fabricexample
1 compromised version
- Aug 7, 2024
Malware in mapbox-maps-android
1 compromised version
- Aug 7, 2024
Malicious code in litebs64 (npm)
- Aug 7, 2024
Malicious code in bs58node (npm)
1 compromised version
- Aug 7, 2024
Malicious code in bs58lite (npm)
- Aug 7, 2024
Malicious code in bignit.js (npm)
- Aug 7, 2024
Malware in bs58node
1 compromised version
- Aug 7, 2024
Malware in litebs64
1 compromised version
- Aug 7, 2024
Malware in bs58lite
1 compromised version
- Aug 7, 2024
Malware in nodebs58
1 compromised version
- Aug 7, 2024
Malware in bignit.js
1 compromised version
- Aug 7, 2024
Malicious code in theme-bahrain-nb-hdddc (npm)
2 compromised versions
- Aug 7, 2024
Malicious code in theme-bahrain-nb-hddd2c (npm)
- Aug 7, 2024
Malware in theme-bahrain-nb-hdddc3
1 compromised version
- Aug 7, 2024
Malware in theme-bahrain-nb-hddd2c
1 compromised version
- Aug 7, 2024
Malware in theme-bahrain-nb-hdddc
1 compromised version
- Aug 6, 2024
Malicious code in gdpr-cookie-consent (npm)
1 compromised version
- Aug 6, 2024
Malicious code in @taxify/react-api-gateway (npm)
4 compromised versions
- Aug 6, 2024
Malicious code in @taxify/city-borders (npm)
3 compromised versions
- Aug 6, 2024
Malicious code in @taxify/trippricing (npm)
3 compromised versions
- Aug 6, 2024
Malicious code in @taxify/eslint-config-react-native (npm)
5 compromised versions
- Aug 6, 2024
Malicious code in @taxify/smartpickups (npm)
4 compromised versions
- Aug 6, 2024
Malicious code in theme-bahrain-nb-hdddc3 (npm)
1 compromised version
Page 6134 of 6,646