Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,266 total in npm · sorted newest first- Jun 25, 2024
Malicious code in react-spring-v7 (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in react-select-custom-commit (npm)
1 compromised version
- Jun 25, 2024
Malicious code in react-router-dom-v7 (npm)
1 compromised version
- Jun 25, 2024
Malicious code in react-router-dom-v6 (npm)
9 compromised versions
- Jun 25, 2024
Malicious code in react-influxdb (npm)
1 compromised version
- Jun 25, 2024
Malicious code in react-hook-form-deprecated (npm)
1 compromised version
- Jun 25, 2024
Malicious code in react-forms-middleware (npm)
1 compromised version
- Jun 25, 2024
Malicious code in react-form-middleware (npm)
1 compromised version
- Jun 25, 2024
Malicious code in react-circular-pick (npm)
1 compromised version
- Jun 25, 2024
Malicious code in rcepackage144 (npm)
1 compromised version
- Jun 25, 2024
Malicious code in rcepackage111 (npm)
1 compromised version
- Jun 25, 2024
Malicious code in rcepackage0 (npm)
1 compromised version
- Jun 25, 2024
Malicious code in rcepackage (npm)
1 compromised version
- Jun 25, 2024
Malicious code in rcal_api (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in raushan (npm)
1 compromised version
- Jun 25, 2024
Malicious code in rappitrap (npm)
1 compromised version
- Jun 25, 2024
Malicious code in rappi-node (npm)
1 compromised version
- Jun 25, 2024
Malicious code in random_hash_halisi (npm)
1 compromised version
- Jun 25, 2024
Malicious code in query-string-cjs (npm)
1 compromised version
- Jun 25, 2024
Malicious code in qubitsdk (npm)
1 compromised version
- Jun 25, 2024
Malicious code in qubit-placement-callbacks (npm)
1 compromised version
- Jun 25, 2024
Malicious code in qatar-digital-webkit (npm)
1 compromised version
- Jun 25, 2024
Malicious code in pxs-map (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in protect-and-track (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in projectdiscovery (npm)
1 compromised version
- Jun 25, 2024
Malicious code in profile-one-frontend (npm)
1 compromised version
- Jun 25, 2024
Malicious code in prod-env-variables (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in privaterepository (npm)
1 compromised version
- Jun 25, 2024
Malicious code in primeng-iow (npm)
1 compromised version
- Jun 25, 2024
Malicious code in preset-react-app (npm)
1 compromised version
- Jun 25, 2024
Malicious code in preply (npm)
1 compromised version
- Jun 25, 2024
Malicious code in powpeg-details (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in power1 (npm)
1 compromised version
- Jun 25, 2024
Malicious code in postman-labs-docs (npm)
1 compromised version
- Jun 25, 2024
Malicious code in portm-agent (npm)
1 compromised version
- Jun 25, 2024
Malicious code in portal-node-logger (npm)
6 compromised versions
- Jun 25, 2024
Malicious code in portal-frontend-public (npm)
1 compromised version
- Jun 25, 2024
Malicious code in port-common (npm)
1 compromised version
- Jun 25, 2024
Malicious code in polaris-viz (npm)
1 compromised version
- Jun 25, 2024
Malicious code in poc-test-package (npm)
1 compromised version
- Jun 25, 2024
Malicious code in plumo-verifier-web (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in plugins-bot (npm)
1 compromised version
- Jun 25, 2024
Malicious code in plugin-react-hooks (npm)
1 compromised version
- Jun 25, 2024
Malicious code in platformdirs (npm)
1 compromised version
- Jun 25, 2024
Malicious code in pkg-with-peer-deps (npm)
1 compromised version
- Jun 25, 2024
Malicious code in pino-deploy (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in pilvarctf (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in piercing-library (npm)
1 compromised version
- Jun 25, 2024
Malicious code in picket-fe-bundler (npm)
1 compromised version
- Jun 25, 2024
Malicious code in pickby (npm)
3 compromised versions
Page 6182 of 6,646