Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,272 total in npm · sorted newest first- Jul 3, 2024
Malware in msa-common
1 compromised version
- Jul 3, 2024
Malicious code in demo-51200 (npm)
1 compromised version
- Jul 2, 2024
Malicious code in bluefin-exchange-contracts-evm (npm)
1 compromised version
- Jul 2, 2024
Malicious code in orderly-omnichain-occ (npm)
1 compromised version
- Jul 2, 2024
Malware in orderly-omnichain-occ
1 compromised version
- Jul 1, 2024
Malicious code in prpc-client-instance.js (npm)
1 compromised version
- Jul 1, 2024
Malicious code in puredocx (npm)
- Jul 1, 2024
Malware in puredocx
1 compromised version
- Jul 1, 2024
Malware in @wdp-gov/catalog-serialization-engine
1 compromised version
- Jul 1, 2024
Malware in @wdp-gov/lineage-component
1 compromised version
- Jul 1, 2024
Malicious code in djs14-checker (npm)
1 compromised version
- Jul 1, 2024
Malware in djs14-checker
1 compromised version
- Jul 1, 2024
Malicious code in viona-atm-payment (npm)
9 compromised versions
- Jul 1, 2024
Malicious code in vio-captcha (npm)
- Jul 1, 2024
Malicious code in check-credit (npm)
- Jul 1, 2024
Malware in check-credit
1 compromised version
- Jul 1, 2024
Malware in vio-captcha
1 compromised version
- Jul 1, 2024
Malware in viona-atm-payment
1 compromised version
- Jul 1, 2024
Malicious code in blue-oval-theme (npm)
1 compromised version
- Jun 30, 2024
Malicious code in auth0-mailchimp-export (npm)
1 compromised version
- Jun 29, 2024
Malicious code in iobeya-time-utils (npm)
1 compromised version
- Jun 29, 2024
Malicious code in kiln-desktop (npm)
1 compromised version
- Jun 29, 2024
Malicious code in bageth (npm)
2 compromised versions
- Jun 28, 2024
Malicious code in @yu-life/yulife-bdd-framework (npm)
1 compromised version
- Jun 28, 2024
Malicious code in @yu-life/react-native-yu-watch (npm)
1 compromised version
- Jun 28, 2024
Malicious code in @rfv/modules (npm)
1 compromised version
- Jun 28, 2024
Malware in @rfv/modules
1 compromised version
- Jun 28, 2024
Malicious code in @freetime/core-utils (npm)
- Jun 28, 2024
Malware in @freetime/core-utils
1 compromised version
- Jun 28, 2024
Malicious code in colors-names (npm)
- Jun 28, 2024
Malware in colors-names
1 compromised version
- Jun 28, 2024
Malicious code in cssyx (npm)
- Jun 28, 2024
Malicious code in ajexx (npm)
1 compromised version
- Jun 28, 2024
Malware in cssyx
1 compromised version
- Jun 28, 2024
Malware in ajexx
1 compromised version
- Jun 28, 2024
Malicious code in lnx-integrity-check-prop (npm)
1 compromised version
- Jun 28, 2024
Malware in lnx-integrity-check-prop
1 compromised version
- Jun 28, 2024
Malicious code in sol-web3-1.45 (npm)
4 compromised versions
- Jun 28, 2024
Malware in sol-web3-1.45
1 compromised version
- Jun 27, 2024
Malicious code in @cloee/fetchs (npm)
5 compromised versions
- Jun 27, 2024
Malware in @cloee/fetchs
1 compromised version
- Jun 27, 2024
Malicious code in world-id-onchain-starter (npm)
4 compromised versions
- Jun 27, 2024
Malicious code in near-linkdrop-contract (npm)
- Jun 27, 2024
Malicious code in mwp-localtunnel-client (npm)
5 compromised versions
- Jun 27, 2024
Malware in near-linkdrop-contract
1 compromised version
- Jun 27, 2024
Malware in govgen-governance
1 compromised version
- Jun 27, 2024
Malware in world-id-onchain-starter
1 compromised version
- Jun 27, 2024
Malware in mwp-localtunnel-client
1 compromised version
- Jun 27, 2024
Malware in stablecoin-evm
1 compromised version
- Jun 27, 2024
Malicious code in gradient-tiny (npm)
Page 6161 of 6,646