Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,265 total in npm · sorted newest first- Jun 18, 2024
Malware in detailimg
1 compromised version
- Jun 18, 2024
Malware in imagezz
1 compromised version
- Jun 17, 2024
Malicious code in delta0231 (npm)
1 compromised version
- Jun 17, 2024
Malicious code in commando333333 (npm)
1 compromised version
- Jun 17, 2024
Malicious code in dc-test1-asdf (npm)
4 compromised versions
- Jun 17, 2024
Malware in pwnkunwar
1 compromised version
- Jun 17, 2024
Malicious code in corraldev-activationsvc (npm)
- Jun 17, 2024
Malicious code in @corraldev/cli (npm)
- Jun 17, 2024
Malware in @corraldev/cli
1 compromised version
- Jun 17, 2024
Malware in braintree-rpc
1 compromised version
- Jun 17, 2024
Malware in corraldev-activationsvc
1 compromised version
- Jun 17, 2024
Malware in braintree-utilities
1 compromised version
- Jun 17, 2024
Malware in @yoimiiya/fetchs
1 compromised version
- Jun 17, 2024
Malware in colors-styles
1 compromised version
- Jun 17, 2024
Malicious code in airbnb-o2 (npm)
1 compromised version
- Jun 16, 2024
Malware in @cart-ui/core-i18n
1 compromised version
- Jun 15, 2024
Malicious code in employee-schedule (npm)
1 compromised version
- Jun 14, 2024
Malicious code in uxcamreactexample (npm)
1 compromised version
- Jun 14, 2024
Malicious code in @cart-ui/core-i18n (npm)
1 compromised version
- Jun 14, 2024
Malicious code in @yoimiiya/fetchs (npm)
4 compromised versions
- Jun 13, 2024
Malicious code in trip-component-platform-online-subscribe-checkbox (npm)
2 compromised versions
- Jun 13, 2024
Malicious code in colors-styles (npm)
1 compromised version
- Jun 13, 2024
Malicious code in elasticsearch-client-specification (npm)
1 compromised version
- Jun 13, 2024
Malicious code in djangosnippets.org (npm)
- Jun 13, 2024
Malware in djangosnippets.org
1 compromised version
- Jun 13, 2024
Malware in elasticsearch-client-specification
1 compromised version
- Jun 13, 2024
Malware in virtuoso-ui-common
1 compromised version
- Jun 13, 2024
Malicious code in legacyreact-aws-s3-typescript (npm)
6 compromised versions
- Jun 13, 2024
Malware in legacyreact-aws-s3-typescript
1 compromised version
- Jun 13, 2024
Malicious code in dependences (npm)
1 compromised version
- Jun 13, 2024
Malware in dependences
1 compromised version
- Jun 13, 2024
Malicious code in @yashorg/frontend-logger (npm)
1 compromised version
- Jun 13, 2024
Malware in @yashorg/frontend-logger
1 compromised version
- Jun 12, 2024
Malicious code in v2-core (npm)
- Jun 12, 2024
Malware in aws-check
1 compromised version
- Jun 12, 2024
Malware in v2-core
1 compromised version
- Jun 12, 2024
Malware in aws-public
1 compromised version
- Jun 12, 2024
Malicious code in ozonid (npm)
- Jun 12, 2024
Malicious code in ozon-js (npm)
- Jun 12, 2024
Malicious code in exel-js (npm)
- Jun 12, 2024
Malicious code in core-webpack (npm)
- Jun 12, 2024
Malware in aws-logs
1 compromised version
- Jun 12, 2024
Malware in ozonid
1 compromised version
- Jun 12, 2024
Malware in ozon-js
1 compromised version
- Jun 12, 2024
Malware in exel-js
1 compromised version
- Jun 12, 2024
Malware in randombullshitgo-js
1 compromised version
- Jun 12, 2024
Malware in core-webpack
1 compromised version
- Jun 12, 2024
Malicious code in ing-feat-lu-luxtrust-smartcard-authentication (npm)
1 compromised version
- Jun 12, 2024
Malicious code in ing-feat-lu-luxtrust-token-authentication (npm)
1 compromised version
- Jun 12, 2024
Malicious code in ing-feat-lu-luxtrust-stick-authentication (npm)
1 compromised version
Page 6210 of 6,646