Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,265 total in npm · sorted newest first- Mar 15, 2024
Malicious code in test12323123 (npm)
- Mar 15, 2024
Malware in test12323123
1 compromised version
- Mar 15, 2024
Malicious code in geico_design_kit2 (npm)
1 compromised version
- Mar 15, 2024
Malicious code in geico_design_kit (npm)
1 compromised version
- Mar 14, 2024
Malware in edgenuity
1 compromised version
- Mar 14, 2024
Malicious code in vinayak (npm)
- Mar 14, 2024
Malware in vinayak
1 compromised version
- Mar 14, 2024
Malicious code in edgenuity (npm)
2 compromised versions
- Mar 13, 2024
Malicious code in fhir.base.template (npm)
1 compromised version
- Mar 13, 2024
Malicious code in sdge-it-tdg-dynamicloadprofiles-sempra-poc (npm)
1 compromised version
- Mar 13, 2024
Malicious code in wm-lib-api-error-handler (npm)
1 compromised version
- Mar 12, 2024
Malicious code in sap.m (npm)
1 compromised version
- Mar 12, 2024
Malicious code in ccl-product-carousel (npm)
2 compromised versions
- Mar 12, 2024
Malware in ccl-product-carousel
1 compromised version
- Mar 12, 2024
Malicious code in shereyas (npm)
- Mar 12, 2024
Malware in shereyas
1 compromised version
- Mar 12, 2024
Malware in profectus-components
1 compromised version
- Mar 12, 2024
Malware in payatutest
1 compromised version
- Mar 12, 2024
Malicious code in pod-consumer-backend (npm)
- Mar 12, 2024
Malicious code in mastercard-postman-encryption-lib (npm)
- Mar 12, 2024
Malware in mastercard-postman-encryption-lib
1 compromised version
- Mar 12, 2024
Malware in open-banking-reference-application
1 compromised version
- Mar 12, 2024
Malware in dismissprovider
1 compromised version
- Mar 12, 2024
Malware in pod-consumer-backend
1 compromised version
- Mar 12, 2024
Malware in accessibletrap
1 compromised version
- Mar 12, 2024
Malware in ifl-primitives
1 compromised version
- Mar 12, 2024
Malware in dropdownformfield
1 compromised version
- Mar 12, 2024
Malware in ifl-css
1 compromised version
- Mar 12, 2024
Malicious code in rat-patrol (npm)
- Mar 12, 2024
Malware in rat-patrol
1 compromised version
- Mar 12, 2024
Malicious code in sempra-npm-poc (npm)
1 compromised version
- Mar 12, 2024
Malicious code in starknet4 (npm)
- Mar 12, 2024
Malicious code in salesforce-service-cloud (npm)
1 compromised version
- Mar 12, 2024
Malicious code in npm_macos (npm)
1 compromised version
- Mar 12, 2024
Malicious code in liquity (npm)
1 compromised version
- Mar 12, 2024
Malicious code in dcplot (npm)
1 compromised version
- Mar 12, 2024
Malware in webauthn-site-poc
1 compromised version
- Mar 12, 2024
Malware in salesforce-service-cloud
1 compromised version
- Mar 12, 2024
Malware in liquity
1 compromised version
- Mar 12, 2024
Malware in attrstore
1 compromised version
- Mar 12, 2024
Malware in c3-pricecaster
1 compromised version
- Mar 12, 2024
Malware in starknet4
1 compromised version
- Mar 12, 2024
Malware in dcplot
1 compromised version
- Mar 12, 2024
Malware in zksync-hardhat-template
1 compromised version
- Mar 12, 2024
Malware in npm_macos
1 compromised version
- Mar 12, 2024
Malicious code in bugcrowd-npm-poc (npm)
1 compromised version
- Mar 12, 2024
Malicious code in udp-components (npm)
2 compromised versions
- Mar 12, 2024
Malware in unity-util
1 compromised version
- Mar 12, 2024
Malware in unity-httpclient
1 compromised version
- Mar 12, 2024
Malware in unity-context
1 compromised version
Page 6228 of 6,646