Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,272 total in npm · sorted newest first- Jun 27, 2024
Malicious code in colors-flag (npm)
- Jun 27, 2024
Malware in colors-flag
1 compromised version
- Jun 27, 2024
Malware in gradient-tiny
1 compromised version
- Jun 26, 2024
Malicious code in @wdp-gov/catalog-serialization-engine (npm)
9 compromised versions
- Jun 26, 2024
Malicious code in @wdp-gov/lineage-component (npm)
11 compromised versions
- Jun 26, 2024
Malware in trip-component-platform-online-region-selector
1 compromised version
- Jun 26, 2024
Malware in trip-component-platform-online-subscribe-checkbox
1 compromised version
- Jun 26, 2024
Malicious code in elitebots-prevnames-discord (npm)
6 compromised versions
- Jun 26, 2024
Malicious code in elitebots-prevnames (npm)
- Jun 26, 2024
Malware in elitebots-prevnames-discord
1 compromised version
- Jun 26, 2024
Malware in elitebots-prevnames
1 compromised version
- Jun 25, 2024
Malicious code in internal-udfc-pkg (npm)
5 compromised versions
- Jun 25, 2024
Malicious code in zsbpwebsdktest2 (npm)
1 compromised version
- Jun 25, 2024
Malicious code in zola (npm)
1 compromised version
- Jun 25, 2024
Malicious code in zloirock (npm)
1 compromised version
- Jun 25, 2024
Malicious code in zlatno_runo_pekic_pdf_golkes_a0f (npm)
1 compromised version
- Jun 25, 2024
Malicious code in yinhai-ta3-cloud (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in yinhai-ta3 (npm)
4 compromised versions
- Jun 25, 2024
Malicious code in yinhai-cloud (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in yinhai (npm)
4 compromised versions
- Jun 25, 2024
Malicious code in yelp-test (npm)
1 compromised version
- Jun 25, 2024
Malicious code in yashprv (npm)
1 compromised version
- Jun 25, 2024
Malicious code in yasap-bump (npm)
4 compromised versions
- Jun 25, 2024
Malicious code in yappy_ts (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in y-dot (npm)
7 compromised versions
- Jun 25, 2024
Malicious code in xsolla-commerce-sdk (npm)
1 compromised version
- Jun 25, 2024
Malicious code in xlmhx56 (npm)
1 compromised version
- Jun 25, 2024
Malicious code in xds-count (npm)
1 compromised version
- Jun 25, 2024
Malicious code in xcoode-staple (npm)
1 compromised version
- Jun 25, 2024
Malicious code in xcode-staple (npm)
1 compromised version
- Jun 25, 2024
Malicious code in xc0de-staple (npm)
1 compromised version
- Jun 25, 2024
Malicious code in xbee-wifi-cloud-kit (npm)
1 compromised version
- Jun 25, 2024
Malicious code in www-site (npm)
4 compromised versions
- Jun 25, 2024
Malicious code in wwc22docker (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in ws-paso-jssdk (npm)
1 compromised version
- Jun 25, 2024
Malicious code in wp-delivery-hero-core-v2 (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in worker-service (npm)
1 compromised version
- Jun 25, 2024
Malicious code in woofmd-to-bemjson (npm)
6 compromised versions
- Jun 25, 2024
Malicious code in winston-nelo2 (npm)
1 compromised version
- Jun 25, 2024
Malicious code in who_ask (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in where-watch-john-wick-chapter-4-2023-at-online-streamings-at-home (npm)
1 compromised version
- Jun 25, 2024
Malicious code in where-to-watch-shazam-fury-of-the-gods-fullmovies-free-on-at-home (npm)
1 compromised version
- Jun 25, 2024
Malicious code in where-scream-6-movie-online-frees (npm)
1 compromised version
- Jun 25, 2024
Malicious code in where-creed-3-fullmovies-hd-online-at-homes-frees4khdtv (npm)
1 compromised version
- Jun 25, 2024
Malicious code in whach-watch-tu-jhoothi-main-makkar-on-fullmovies-online-streaming-at-homee2 (npm)
1 compromised version
- Jun 25, 2024
Malicious code in wfui-digital-core (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in wf-dbd-react-ui (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in wessycord (npm)
1 compromised version
- Jun 25, 2024
Malicious code in websocket-cors (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in webauthn-sdzdzte-poc (npm)
1 compromised version
Page 6162 of 6,646