Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,265 total in npm · sorted newest first- Mar 31, 2024
Malicious code in galileo-web-sdk (npm)
6 compromised versions
- Mar 31, 2024
Malicious code in poptoken-builder-node (npm)
1 compromised version
- Mar 31, 2024
Malicious code in secrets-management (npm)
1 compromised version
- Mar 31, 2024
Malicious code in bugsnagmw (npm)
4 compromised versions
- Mar 31, 2024
Malicious code in fe-bitmovin-player (npm)
1 compromised version
- Mar 31, 2024
Malicious code in optus-sport-ctv (npm)
1 compromised version
- Mar 31, 2024
Malicious code in cds-banking-prd-viewer (npm)
1 compromised version
- Mar 31, 2024
Malicious code in amcharts-accessibility-plugin (npm)
1 compromised version
- Mar 30, 2024
Malicious code in xko2x (npm)
1 compromised version
- Mar 29, 2024
Malicious code in tchap-translations (npm)
2 compromised versions
- Mar 29, 2024
Malicious code in wm-search-deployables (npm)
2 compromised versions
- Mar 29, 2024
Malicious code in shelllib (npm)
2 compromised versions
- Mar 29, 2024
Malicious code in u-workflow.module.common.hour-of-week (npm)
1 compromised version
- Mar 27, 2024
Malware in commandlib
1 compromised version
- Mar 27, 2024
Malicious code in createarrayfrommixed (npm)
1 compromised version
- Mar 27, 2024
Malicious code in programmablesearchengine (npm)
1 compromised version
- Mar 27, 2024
Malicious code in region-optimizer (npm)
2 compromised versions
- Mar 27, 2024
Malicious code in @fin-php/npms (npm)
1 compromised version
- Mar 27, 2024
Malicious code in teslamotors-server (npm)
1 compromised version
- Mar 27, 2024
Malicious code in mytmobile (npm)
1 compromised version
- Mar 27, 2024
Malicious code in routepair (npm)
- Mar 27, 2024
Malware in routepair
1 compromised version
- Mar 27, 2024
Malicious code in google-requests (npm)
1 compromised version
- Mar 26, 2024
Malicious code in commandlib (npm)
2 compromised versions
- Mar 26, 2024
Malicious code in gatsby-theme-deriv (npm)
1 compromised version
- Mar 24, 2024
Malicious code in trujillocheck (npm)
- Mar 24, 2024
Malicious code in hessskinchecker (npm)
- Mar 24, 2024
Malicious code in francoadvisor (npm)
- Mar 24, 2024
Malware in francoadvisor
1 compromised version
- Mar 24, 2024
Malware in trujillocheck
1 compromised version
- Mar 24, 2024
Malware in hessskinchecker
1 compromised version
- Mar 24, 2024
Malicious code in win-regi (npm)
- Mar 24, 2024
Malicious code in gkldjdkljgdklfgj (npm)
- Mar 24, 2024
Malicious code in btcbip-39 (npm)
- Mar 24, 2024
Malware in btcbip-39
1 compromised version
- Mar 24, 2024
Malware in win-regi
1 compromised version
- Mar 24, 2024
Malware in gkldjdkljgdklfgj
1 compromised version
- Mar 24, 2024
Malicious code in odyssey-lint-staged (npm)
1 compromised version
- Mar 24, 2024
Malicious code in familylink (npm)
2 compromised versions
- Mar 21, 2024
Malicious code in boukiapi (npm)
- Mar 21, 2024
Malware in boukiapi
1 compromised version
- Mar 21, 2024
Malicious code in tomori-discord (npm)
- Mar 21, 2024
Malicious code in discordinfos (npm)
- Mar 21, 2024
Malware in discordinfos
1 compromised version
- Mar 21, 2024
Malware in tomori-discord
1 compromised version
- Mar 21, 2024
Malware in caas-static
1 compromised version
- Mar 21, 2024
Malicious code in u-workflow.module.common.brand-safety (npm)
1 compromised version
- Mar 21, 2024
Malicious code in u-workflow.module.common.features (npm)
1 compromised version
- Mar 21, 2024
Malicious code in region-selector-content (npm)
2 compromised versions
- Mar 19, 2024
Malicious code in caas-static (npm)
3 compromised versions
Page 6226 of 6,646