Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,278 total in npm · sorted newest first- Jul 31, 2024
Malware in @illimity/hello-world-cryptonetlabs
1 compromised version
- Jul 31, 2024
Malware in @illimity/commons
1 compromised version
- Jul 31, 2024
Malware in @illimity/components
1 compromised version
- Jul 31, 2024
Malicious code in @illimity/rtl-faqs-state (npm)
- Jul 31, 2024
Malicious code in @illimity/core-events (npm)
- Jul 31, 2024
Malicious code in @illimity/core-banking-state (npm)
- Jul 31, 2024
Malware in @illimity/rtl-faqs-state
1 compromised version
- Jul 31, 2024
Malware in @illimity/core-banking-state
1 compromised version
- Jul 31, 2024
Malware in @illimity/core-events
1 compromised version
- Jul 31, 2024
Malicious code in wix-smarts (npm)
- Jul 31, 2024
Malicious code in some-dependency-3 (npm)
- Jul 31, 2024
Malicious code in some-dependency-2 (npm)
- Jul 31, 2024
Malware in some-dependency-2
1 compromised version
- Jul 31, 2024
Malware in wix-smarts
1 compromised version
- Jul 31, 2024
Malware in some-dependency-3
1 compromised version
- Jul 31, 2024
Malware in depe-tool
1 compromised version
- Jul 31, 2024
Malware in wix-smarts-nextjs
1 compromised version
- Jul 31, 2024
Malicious code in toolbox-v2 (npm)
2 compromised versions
- Jul 31, 2024
Malware in toolbox-v2
1 compromised version
- Jul 30, 2024
Malicious code in eslint-plugin-mui-custom (npm)
1 compromised version
- Jul 30, 2024
Malicious code in wix-smarts-nextjs (npm)
1 compromised version
- Jul 30, 2024
Malicious code in psh-hydra-sdk (npm)
2 compromised versions
- Jul 29, 2024
Malicious code in lambda-sns-dynatrace-sdk (npm)
5 compromised versions
- Jul 29, 2024
Malicious code in hlwgirl (npm)
1 compromised version
- Jul 29, 2024
Malicious code in depe-tool (npm)
1 compromised version
- Jul 29, 2024
Malicious code in ent-widget-phone (npm)
- Jul 29, 2024
Malware in ent-widget-unauth-msr-stop
1 compromised version
- Jul 29, 2024
Malware in ent-widget-itin
1 compromised version
- Jul 29, 2024
Malware in usaa-message-card
1 compromised version
- Jul 29, 2024
Malware in ent-cas-proxy
1 compromised version
- Jul 29, 2024
Malware in ent-widget-ssn
1 compromised version
- Jul 29, 2024
Malware in ent-widget-phone
1 compromised version
- Jul 29, 2024
Malware in ent-widget-occupation
1 compromised version
- Jul 29, 2024
Malware in ent-disclosure-mocks
1 compromised version
- Jul 29, 2024
Malware in mmp-test-utils
1 compromised version
- Jul 29, 2024
Malware in usaa-modal
1 compromised version
- Jul 29, 2024
Malicious code in testalonimaurice (npm)
1 compromised version
- Jul 29, 2024
Malicious code in personal-profile-common (npm)
2 compromised versions
- Jul 29, 2024
Malicious code in ent-widget-marital-status (npm)
- Jul 29, 2024
Malicious code in ent-widget-dob (npm)
- Jul 29, 2024
Malicious code in ent-widget-citizenship (npm)
- Jul 29, 2024
Malware in testalonimaurice
1 compromised version
- Jul 29, 2024
Malware in ent-widget-addcap
1 compromised version
- Jul 29, 2024
Malware in ent-widget-address
1 compromised version
- Jul 29, 2024
Malware in ent-widget-gender
1 compromised version
- Jul 29, 2024
Malware in ent-widget-dob
1 compromised version
- Jul 29, 2024
Malware in personal-profile-common
1 compromised version
- Jul 29, 2024
Malware in usaa-a11y-test
1 compromised version
- Jul 29, 2024
Malware in ent-widget-marital-status
1 compromised version
- Jul 29, 2024
Malware in ent-widget-citizenship
1 compromised version
Page 6136 of 6,646