Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,265 total in npm · sorted newest first- May 8, 2024
Malware in jhsdfgghsdfjhds
1 compromised version
- May 8, 2024
Malware in zxcvbnmmmmmmkjhgfdssss
1 compromised version
- May 8, 2024
Malware in actions-next-bundle-analyzer
1 compromised version
- May 6, 2024
Malicious code in discord-fetchers (npm)
1 compromised version
- May 6, 2024
Malware in scundev-pkg
1 compromised version
- May 6, 2024
Malicious code in @ssr-frontend/test-poc3 (npm)
- May 6, 2024
Malware in @ssr-frontend/test-poc3
1 compromised version
- May 6, 2024
Malware in packages-analytics
1 compromised version
- May 6, 2024
Malware in @ssr-frontend/packages-analytics
1 compromised version
- May 6, 2024
Malicious code in test-poc3 (npm)
- May 6, 2024
Malicious code in test-poc2 (npm)
- May 6, 2024
Malware in test-poc2
1 compromised version
- May 6, 2024
Malware in test-poc3
1 compromised version
- May 6, 2024
Malware in discord-color
1 compromised version
- May 6, 2024
Malware in lamia471
1 compromised version
- May 6, 2024
Malicious code in eslint-config1 (npm)
- May 6, 2024
Malicious code in @sxmp/logging (npm)
- May 6, 2024
Malicious code in @sxmp/detector (npm)
- May 6, 2024
Malware in eslint-config1
1 compromised version
- May 6, 2024
Malware in @sxmp/detector
1 compromised version
- May 6, 2024
Malware in @sxmp/logging
1 compromised version
- May 6, 2024
Malicious code in roblox.lua (npm)
1 compromised version
- May 5, 2024
Malicious code in zxcvbnmmmmmmkjhgfdssss (npm)
2 compromised versions
- May 5, 2024
Malicious code in @assurantlabs/home-device-inventory (npm)
1 compromised version
- May 4, 2024
Malicious code in @socialdeal/uikit-whitelabel (npm)
1 compromised version
- May 4, 2024
Malicious code in ing-feat-grants-management (npm)
1 compromised version
- May 4, 2024
Malicious code in @aluffyz/discord-botjs (npm)
3 compromised versions
- May 3, 2024
Malicious code in lamia471 (npm)
1 compromised version
- May 3, 2024
Malicious code in elk-uikit (npm)
2 compromised versions
- May 3, 2024
Malicious code in uidm-react-lib (npm)
3 compromised versions
- May 3, 2024
Malware in viseshthemed
1 compromised version
- May 2, 2024
Malicious code in discord-color (npm)
3 compromised versions
- May 2, 2024
Malicious code in hw-transition-animation (npm)
1 compromised version
- May 2, 2024
Malicious code in epc-primer-ui-tags (npm)
1 compromised version
- May 2, 2024
Malicious code in epc-notification-setting-web (npm)
1 compromised version
- May 2, 2024
Malicious code in scundev-pkg (npm)
1 compromised version
- May 2, 2024
Malware in grylls
1 compromised version
- May 2, 2024
Malicious code in clistsy-node (npm)
- May 2, 2024
Malware in clistsy-node
1 compromised version
- May 2, 2024
Malware in npm-package-shirley
1 compromised version
- May 2, 2024
Malicious code in agencyportal-web (npm)
- May 2, 2024
Malware in agencyportal-web
1 compromised version
- May 1, 2024
Malicious code in viseshthemed (npm)
2 compromised versions
- May 1, 2024
Malicious code in grylls (npm)
1 compromised version
- May 1, 2024
Malicious code in not-exist-lykos-poc2 (npm)
1 compromised version
- May 1, 2024
Malicious code in actions-next-bundle-analyzer (npm)
2 compromised versions
- Apr 30, 2024
Malicious code in discord.js-hex (npm)
3 compromised versions
- Apr 30, 2024
Malicious code in npm-package-shirley (npm)
5 compromised versions
- Apr 30, 2024
Malicious code in vue2-amis-custom-widget-kk (npm)
3 compromised versions
- Apr 30, 2024
Malicious code in vue2-amis-custom-widget-k (npm)
5 compromised versions
Page 6220 of 6,646