Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,265 total in npm · sorted newest first- Jun 25, 2024
Malicious code in @caesars-digital/caesars-ui (npm)
1 compromised version
- Jun 25, 2024
Malicious code in easystart (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in @bluekiri/alexandria-logitravel (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @bluekiri/alexandria (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @bizone/prettier_config (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @bizone/prettier.config (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @bizone/prettier-config (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @bitkub-moonshot/common (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @bitkub-moonshot/bitkubx-wallet (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @betterbit-library/tools (npm)
1 compromised version
- Jun 25, 2024
Malicious code in fca-badol (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @b2bgeo/yav (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @b2bgeo/utils (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @chegg-me-lpc/utils (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @b2bgeo/tanker (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @b2bgeo/run-in-packages (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @b2bgeo/run-if-changed (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @b2bgeo/map-icons (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @b2bgeo/frontend-server-api-types (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @b2bgeo/design-system (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @b2bgeo/configs (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @b2bgeo/ci-startrek (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @b2bgeo/ci-s3 (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @b2bgeo/ci-github (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @b2bgeo/ci-aws (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @b2bgeo/certs (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @b2bgeo/backend-api-types (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @atomiczsec/efx-angular-components (npm)
1 compromised version
- Jun 25, 2024
Malicious code in efx-angular-components (npm)
4 compromised versions
- Jun 25, 2024
Malicious code in @arene-warp/core (npm)
5 compromised versions
- Jun 25, 2024
Malicious code in @reciclos/core (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @aligntech-cw/alignerfit (npm)
1 compromised version
- Jun 25, 2024
Malicious code in front-locales (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in @ag-grid-react/lib (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @adminhub-page/emails (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @ably-forks/crypto-js (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @abdulmz/mz-test (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @abb-americas/image-scaler (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @abb-americas/angular-utilities (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @abb-americas/angular-components (npm)
1 compromised version
- Jun 25, 2024
Malicious code in fing-react-components (npm)
1 compromised version
- Jun 24, 2024
Malware in kami-richtext
1 compromised version
- Jun 24, 2024
Malicious code in kami-richtext (npm)
7 compromised versions
- Jun 24, 2024
Malicious code in @elza/keepalive (npm)
- Jun 24, 2024
Malware in @elza/keepalive
1 compromised version
- Jun 24, 2024
Malicious code in @elza/auto-route-plugin (npm)
- Jun 24, 2024
Malware in @elza/auto-route-plugin
1 compromised version
- Jun 23, 2024
Malicious code in govgen-governance (npm)
2 compromised versions
- Jun 23, 2024
Malicious code in @amops/fetch (npm)
1 compromised version
- Jun 22, 2024
Malicious code in openstad-component-forms (npm)
1 compromised version
Page 6208 of 6,646