Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,265 total in npm · sorted newest first- Apr 22, 2024
Malicious code in blockchain-explorer-api (npm)
6 compromised versions
- Apr 22, 2024
Malicious code in arkime (npm)
2 compromised versions
- Apr 22, 2024
Malware in lambda-iss-location
1 compromised version
- Apr 22, 2024
Malware in tari-explorer
1 compromised version
- Apr 22, 2024
Malware in arkime
1 compromised version
- Apr 22, 2024
Malware in samplenodejsservice
1 compromised version
- Apr 22, 2024
Malware in monitoring-coverage
1 compromised version
- Apr 22, 2024
Malware in blockchain-explorer-api
1 compromised version
- Apr 22, 2024
Malicious code in sid-client-manager (npm)
200 compromised versions
- Apr 22, 2024
Malware in sid-client-manager
1 compromised version
- Apr 19, 2024
Malicious code in djs-log (npm)
2 compromised versions
- Apr 19, 2024
Malware in djs-log
1 compromised version
- Apr 18, 2024
Malicious code in malpac (npm)
- Apr 18, 2024
Malware in malpac
1 compromised version
- Apr 18, 2024
Malicious code in somepackage-marksl (npm)
21 compromised versions
- Apr 18, 2024
Malware in somepackage-marksl
1 compromised version
- Apr 18, 2024
Malicious code in ui-common-components-angular (npm)
2 compromised versions
- Apr 17, 2024
Malicious code in metrics-balancer (npm)
1 compromised version
- Apr 17, 2024
Malicious code in @portal-packages/utils (npm)
1 compromised version
- Apr 17, 2024
Malicious code in @portal-packages/core (npm)
3 compromised versions
- Apr 17, 2024
Malicious code in cz-ifood-conventional-changelog (npm)
1 compromised version
- Apr 16, 2024
Malicious code in commitlint-config-ifood (npm)
1 compromised version
- Apr 16, 2024
Malicious code in web-ar-player (npm)
- Apr 16, 2024
Malicious code in snap-orca (npm)
- Apr 16, 2024
Malicious code in hosted-lenses-ui (npm)
- Apr 16, 2024
Malicious code in bluepurellwalker (npm)
- Apr 16, 2024
Malware in bluepurellwalker
1 compromised version
- Apr 16, 2024
Malware in hosted-lenses-ui
1 compromised version
- Apr 16, 2024
Malware in web-ar-player
1 compromised version
- Apr 16, 2024
Malware in snap-orca
1 compromised version
- Apr 15, 2024
Malicious code in viiiivek (npm)
- Apr 15, 2024
Malicious code in trip-component-platform-online-usp (npm)
- Apr 15, 2024
Malicious code in trip-component-platform-online-prepermission-popup (npm)
- Apr 15, 2024
Malicious code in trip-component-platform-online-header (npm)
- Apr 15, 2024
Malicious code in trip-component-platform-online-goto (npm)
- Apr 15, 2024
Malicious code in trip-component-platform-online-footer (npm)
- Apr 15, 2024
Malicious code in trip-component-platform-online-cookie-banner (npm)
- Apr 15, 2024
Malicious code in heroicons1 (npm)
1 compromised version
- Apr 15, 2024
Malicious code in discourse-markdown-it (npm)
- Apr 15, 2024
Malicious code in discourse-i18n (npm)
- Apr 15, 2024
Malicious code in deprecation-silencer (npm)
- Apr 15, 2024
Malware in viiiivek
1 compromised version
- Apr 15, 2024
Malware in trip-component-platform-online-cookie-banner
1 compromised version
- Apr 15, 2024
Malware in trip-component-platform-online-goto
1 compromised version
- Apr 15, 2024
Malware in discourse-markdown-it
1 compromised version
- Apr 15, 2024
Malware in trip-component-platform-online-footer
1 compromised version
- Apr 15, 2024
Malware in discourse-i18n
1 compromised version
- Apr 15, 2024
Malware in deprecation-silencer
1 compromised version
- Apr 15, 2024
Malware in trip-component-platform-online-usp
1 compromised version
- Apr 15, 2024
Malware in trip-component-platform-online-prepermission-popup
1 compromised version
Page 6222 of 6,646