Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,238 total in npm · sorted newest first- Feb 10, 2024
Malicious code in crumpet (npm)
2 compromised versions
- Feb 10, 2024
Malicious code in @globalsearch/abstraction (npm)
1 compromised version
- Feb 10, 2024
Malicious code in @globalsearch/productstub (npm)
1 compromised version
- Feb 9, 2024
Malicious code in iris-front-test-utils (npm)
1 compromised version
- Feb 9, 2024
Malicious code in prism-commercial-ui (npm)
13 compromised versions
- Feb 8, 2024
Malicious code in privdel (npm)
1 compromised version
- Feb 7, 2024
Malicious code in styled-compoment (npm)
- Feb 7, 2024
Malicious code in dependency-ab (npm)
- Feb 7, 2024
Malware in styled-compoment
1 compromised version
- Feb 7, 2024
Malware in dependency-ab
1 compromised version
- Feb 7, 2024
Malicious code in paradis (npm)
- Feb 7, 2024
Malicious code in nhatcoder-fb-api (npm)
- Feb 7, 2024
Malware in paradis
1 compromised version
- Feb 7, 2024
Malware in nhatcoder-fb-api
1 compromised version
- Feb 7, 2024
Malicious code in @bughunter0007/packages-analytics (npm)
3 compromised versions
- Feb 7, 2024
Malicious code in packages-analytic (npm)
1 compromised version
- Feb 7, 2024
Malicious code in discord.js-commandv14.1 (npm)
1 compromised version
- Feb 7, 2024
Malicious code in packages-analytics (npm)
1 compromised version
- Feb 7, 2024
Malicious code in internal-corp-package (npm)
1 compromised version
- Feb 7, 2024
Malicious code in discord.js-commandv14 (npm)
1 compromised version
- Feb 7, 2024
Malware in jera
1 compromised version
- Feb 7, 2024
Malicious code in test-pkg1-random (npm)
- Feb 7, 2024
Malicious code in can-explorer (npm)
- Feb 7, 2024
Malware in can-explorer
1 compromised version
- Feb 7, 2024
Malware in test-pkg1-random
1 compromised version
- Feb 6, 2024
Malicious code in @ssr-frontend/packages-analytics (npm)
6 compromised versions
- Feb 6, 2024
Malicious code in bug-test-package (npm)
- Feb 6, 2024
Malicious code in auto-issues (npm)
5 compromised versions
- Feb 6, 2024
Malware in auto-issues
1 compromised version
- Feb 6, 2024
Malware in bug-test-package
1 compromised version
- Feb 5, 2024
Malicious code in ngpd-merceros-ui-widget-core (npm)
- Feb 5, 2024
Malicious code in ngpd-merceros-ui-meta (npm)
- Feb 5, 2024
Malicious code in ngpd-merceros-dynamic-forms-fe-components (npm)
- Feb 5, 2024
Malicious code in health-gbm-common (npm)
- Feb 5, 2024
Malware in ngpd-merceros-dynamic-forms-fe-components
1 compromised version
- Feb 5, 2024
Malware in ngpd-merceros-ui-widget-core
1 compromised version
- Feb 5, 2024
Malware in health-gbm-common
1 compromised version
- Feb 5, 2024
Malware in ngpd-merceros-ui-meta
1 compromised version
- Feb 5, 2024
Malware in librct
1 compromised version
- Feb 5, 2024
Malicious code in nan-win (npm)
- Feb 5, 2024
Malware in nan-win
1 compromised version
- Feb 5, 2024
Malware in hub-blockly
1 compromised version
- Feb 5, 2024
Malware in @time-loop/electron-panel-window
1 compromised version
- Feb 4, 2024
Malicious code in jera (npm)
3 compromised versions
- Feb 3, 2024
Malicious code in cifuzz (npm)
1 compromised version
- Feb 3, 2024
Malicious code in discord.js-commandsv14 (npm)
4 compromised versions
- Feb 2, 2024
Malicious code in ccl-modal (npm)
1 compromised version
- Feb 2, 2024
Malicious code in hub-blockly (npm)
1 compromised version
- Feb 2, 2024
Malicious code in @time-loop/electron-panel-window (npm)
1 compromised version
- Feb 2, 2024
Malicious code in node-production (npm)
Page 6231 of 6,645