Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,265 total in npm · sorted newest first- Jun 11, 2024
Malware in coe.com
1 compromised version
- Jun 11, 2024
Malicious code in aws-public (npm)
1 compromised version
- Jun 11, 2024
Malicious code in nppe_ttt_datalayer (npm)
1 compromised version
- Jun 11, 2024
Malware in purina-parent-theme
1 compromised version
- Jun 11, 2024
Malware in nppe_ttt_datalayer
1 compromised version
- Jun 11, 2024
Malicious code in workerd-root (npm)
1 compromised version
- Jun 11, 2024
Malware in workerd-root
1 compromised version
- Jun 11, 2024
Malware in hybrid-custody
1 compromised version
- Jun 11, 2024
Malware in glamorous-codemods
1 compromised version
- Jun 11, 2024
Malware in vue-webviews
1 compromised version
- Jun 11, 2024
Malware in vue2-webviews
1 compromised version
- Jun 10, 2024
Malicious code in randombullshitgo-js (npm)
1 compromised version
- Jun 10, 2024
Malicious code in aws-check (npm)
1 compromised version
- Jun 10, 2024
Malicious code in aws-logs (npm)
1 compromised version
- Jun 10, 2024
Malicious code in rb-payment-wallet (npm)
1 compromised version
- Jun 9, 2024
Malicious code in test-pkg-blabla (npm)
14 compromised versions
- Jun 9, 2024
Malicious code in pwnkunwar (npm)
1 compromised version
- Jun 9, 2024
Malicious code in scm-design-system-cra (npm)
1 compromised version
- Jun 9, 2024
Malicious code in braintree-rpc (npm)
2 compromised versions
- Jun 9, 2024
Malicious code in braintree-utilities (npm)
2 compromised versions
- Jun 8, 2024
Malicious code in cosma-ui-icons (npm)
1 compromised version
- Jun 8, 2024
Malicious code in glamorous-codemods (npm)
1 compromised version
- Jun 8, 2024
Malicious code in rey-vue-smarttable (npm)
2 compromised versions
- Jun 8, 2024
Malicious code in rey-vue-common (npm)
3 compromised versions
- Jun 7, 2024
Malicious code in hybrid-custody (npm)
1 compromised version
- Jun 7, 2024
Malicious code in @ing-caf/cdn-proxy-plugin (npm)
1 compromised version
- Jun 7, 2024
Malicious code in purina-parent-theme (npm)
1 compromised version
- Jun 7, 2024
Malicious code in integration-web-core--socle (npm)
1 compromised version
- Jun 7, 2024
Malicious code in vue2-webviews (npm)
1 compromised version
- Jun 7, 2024
Malicious code in vue-webviews (npm)
1 compromised version
- Jun 6, 2024
Malicious code in ing-feat-uilib-de (npm)
1 compromised version
- Jun 6, 2024
Malicious code in ing-shared-navigation-de (npm)
1 compromised version
- Jun 6, 2024
Malicious code in testpentesting123xyz (npm)
1 compromised version
- Jun 6, 2024
Malicious code in node-pre-gyp-test-app2 (npm)
1 compromised version
- Jun 6, 2024
Malicious code in pentesters987abc (npm)
1 compromised version
- Jun 6, 2024
Malicious code in mapbox-demo-gl-style-spec (npm)
1 compromised version
- Jun 5, 2024
Malicious code in com.unity.cloud.gltfast (npm)
- Jun 5, 2024
Malware in com.unity.cloud.gltfast
1 compromised version
- Jun 5, 2024
Malicious code in e2e-frontend (npm)
1 compromised version
- Jun 5, 2024
Malicious code in ewf-mfe (npm)
1 compromised version
- Jun 5, 2024
Malicious code in fccui (npm)
2 compromised versions
- Jun 4, 2024
Malicious code in client-onboarding (npm)
1 compromised version
- Jun 4, 2024
Malicious code in cpr-mfe (npm)
1 compromised version
- Jun 4, 2024
Malicious code in glup-debugger-log (npm)
- Jun 4, 2024
Malware in glup-debugger-log
1 compromised version
- Jun 4, 2024
Malicious code in h5guard (npm)
1 compromised version
- Jun 3, 2024
Malicious code in winextracter (npm)
- Jun 3, 2024
Malicious code in win66lib (npm)
- Jun 3, 2024
Malicious code in testone-avisheknayal (npm)
- Jun 3, 2024
Malicious code in test-lib-avishek (npm)
Page 6212 of 6,646