Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,265 total in npm · sorted newest first- Mar 12, 2024
Malware in udp-components
1 compromised version
- Mar 11, 2024
Malicious code in open-banking-reference-application (npm)
1 compromised version
- Mar 10, 2024
Malicious code in attrstore (npm)
1 compromised version
- Mar 10, 2024
Malicious code in payatutest (npm)
1 compromised version
- Mar 10, 2024
Malicious code in dismissprovider (npm)
1 compromised version
- Mar 9, 2024
Malicious code in webauthn-site-poc (npm)
1 compromised version
- Mar 9, 2024
Malicious code in zksync-hardhat-template (npm)
1 compromised version
- Mar 9, 2024
Malicious code in jitsi-meet-electron (npm)
1 compromised version
- Mar 9, 2024
Malicious code in ifl-css (npm)
1 compromised version
- Mar 9, 2024
Malicious code in global-min-document (npm)
1 compromised version
- Mar 9, 2024
Malicious code in profectus-components (npm)
3 compromised versions
- Mar 9, 2024
Malicious code in dropdownformfield (npm)
1 compromised version
- Mar 9, 2024
Malicious code in accessibletrap (npm)
1 compromised version
- Mar 8, 2024
Malicious code in ycs (npm)
3 compromised versions
- Mar 8, 2024
Malicious code in unity-httpclient (npm)
1 compromised version
- Mar 8, 2024
Malicious code in unity-context (npm)
1 compromised version
- Mar 8, 2024
Malicious code in unity-util (npm)
1 compromised version
- Mar 8, 2024
Malicious code in pet-profile-micro-interaction (npm)
1 compromised version
- Mar 8, 2024
Malware in pet-profile-micro-interaction
1 compromised version
- Mar 8, 2024
Malicious code in @spectrocoin/sc-currencies (npm)
2 compromised versions
- Mar 7, 2024
Malicious code in jaas-jwt (npm)
1 compromised version
- Mar 7, 2024
Malicious code in pcln-event-dispatcher (npm)
4 compromised versions
- Mar 6, 2024
Malicious code in c3-pricecaster (npm)
2 compromised versions
- Mar 6, 2024
Malicious code in add-sugar (npm)
4 compromised versions
- Mar 5, 2024
Malicious code in win32crypted (npm)
- Mar 5, 2024
Malware in win32crypted
1 compromised version
- Mar 3, 2024
Malicious code in testien1 (npm)
1 compromised version
- Mar 3, 2024
Malicious code in relativity-web-component (npm)
3 compromised versions
- Mar 2, 2024
Malicious code in build-benchmarks (npm)
1 compromised version
- Mar 1, 2024
Malicious code in sdge-it-tdg-dynamicloadprofiles (npm)
2 compromised versions
- Mar 1, 2024
Malicious code in @apics/apps-ppp-web (npm)
5 compromised versions
- Feb 29, 2024
Malicious code in tokenspair (npm)
- Feb 29, 2024
Malicious code in tokenpairs (npm)
- Feb 29, 2024
Malware in tokenspair
1 compromised version
- Feb 29, 2024
Malware in tokenpairs
1 compromised version
- Feb 29, 2024
Malicious code in tokenpair (npm)
- Feb 29, 2024
Malware in tokenpair
1 compromised version
- Feb 28, 2024
Malicious code in bubble-dev (npm)
2 compromised versions
- Feb 28, 2024
Malicious code in ux1-ui-kit-theme (npm)
1 compromised version
- Feb 27, 2024
Malicious code in is24-desktop (npm)
4 compromised versions
- Feb 27, 2024
Malicious code in emilkylandertestnpmpackge (npm)
- Feb 27, 2024
Malware in emilkylandertestnpmpackge
1 compromised version
- Feb 27, 2024
Malicious code in frd-rsa-js (npm)
- Feb 27, 2024
Malware in frd-rsa-js
1 compromised version
- Feb 27, 2024
Malware in usaa-wdio-utils
1 compromised version
- Feb 27, 2024
Malicious code in ent-profile-logger (npm)
- Feb 27, 2024
Malware in ent-profile-logger
1 compromised version
- Feb 26, 2024
Malicious code in nodejs-socket (npm)
- Feb 26, 2024
Malware in nodejs-socket
1 compromised version
- Feb 24, 2024
Malicious code in virtuoso-ui-common (npm)
5 compromised versions
Page 6229 of 6,646