Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,265 total in npm · sorted newest first- Apr 30, 2024
Malware in vue2-amis-custom-widget-kk
1 compromised version
- Apr 30, 2024
Malware in vue2-amis-custom-widget-k
1 compromised version
- Apr 30, 2024
Malicious code in not-exist-lykos-poc (npm)
1 compromised version
- Apr 29, 2024
Malicious code in discords-logs (npm)
1 compromised version
- Apr 29, 2024
Malicious code in minecraft-net-core-services (npm)
2 compromised versions
- Apr 29, 2024
Malicious code in discord.js-red (npm)
- Apr 29, 2024
Malware in discord.js-red
1 compromised version
- Apr 29, 2024
Malicious code in ethutility (npm)
- Apr 29, 2024
Malware in ethutility
1 compromised version
- Apr 29, 2024
Malicious code in ethers-transactions (npm)
9 compromised versions
- Apr 29, 2024
Malware in ethers-transactions
1 compromised version
- Apr 24, 2024
Malicious code in rollremainsweet (npm)
- Apr 24, 2024
Malicious code in relinquishsecurecontinuous (npm)
- Apr 24, 2024
Malicious code in pleadappointmentat (npm)
- Apr 24, 2024
Malicious code in pardonbeefconfession (npm)
- Apr 24, 2024
Malicious code in driftdegreerubbish (npm)
- Apr 24, 2024
Malware in pardonbeefconfession
1 compromised version
- Apr 24, 2024
Malware in driftdegreerubbish
1 compromised version
- Apr 24, 2024
Malware in relinquishsecurecontinuous
1 compromised version
- Apr 24, 2024
Malware in rollremainsweet
1 compromised version
- Apr 24, 2024
Malware in pleadappointmentat
1 compromised version
- Apr 23, 2024
Malware in @ebay/ui-core-react
1 compromised version
- Apr 23, 2024
Malicious code in dev-ansi-terminal (npm)
- Apr 23, 2024
Malware in dev-ansi-terminal
1 compromised version
- Apr 23, 2024
Malicious code in colors-main (npm)
2 compromised versions
- Apr 23, 2024
Malware in colors-main
1 compromised version
- Apr 22, 2024
Malicious code in @symplr-ux/alloy-icons (npm)
- Apr 22, 2024
Malware in @symplr-ux/alloy-icons
1 compromised version
- Apr 22, 2024
Malicious code in teleport-app-example-node (npm)
1 compromised version
- Apr 22, 2024
Malicious code in swift-docc-rendeeeeeer (npm)
- Apr 22, 2024
Malicious code in shard-packages (npm)
- Apr 22, 2024
Malicious code in ecs-cdk (npm)
- Apr 22, 2024
Malicious code in cuckoo-3-web-ui-tooling (npm)
- Apr 22, 2024
Malware in shard-packages
1 compromised version
- Apr 22, 2024
Malware in ecs-cdk
1 compromised version
- Apr 22, 2024
Malware in swift-docc-rendeeeeeer
1 compromised version
- Apr 22, 2024
Malware in cuckoo-3-web-ui-tooling
1 compromised version
- Apr 22, 2024
Malware in teleport-app-example-node
1 compromised version
- Apr 22, 2024
Malicious code in djs-status (npm)
3 compromised versions
- Apr 22, 2024
Malicious code in djs-embeds-v2 (npm)
- Apr 22, 2024
Malicious code in discord-caches (npm)
- Apr 22, 2024
Malware in djs-status
1 compromised version
- Apr 22, 2024
Malware in djs-embeds-v2
1 compromised version
- Apr 22, 2024
Malware in discord-caches
1 compromised version
- Apr 22, 2024
Malicious code in waveapi (npm)
- Apr 22, 2024
Malware in waveapi
1 compromised version
- Apr 22, 2024
Malicious code in tari-explorer (npm)
12 compromised versions
- Apr 22, 2024
Malicious code in samplenodejsservice (npm)
7 compromised versions
- Apr 22, 2024
Malicious code in monitoring-coverage (npm)
5 compromised versions
- Apr 22, 2024
Malicious code in lambda-iss-location (npm)
5 compromised versions
Page 6221 of 6,646