Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,238 total in npm · sorted newest first- Jan 17, 2024
Malicious code in discord.js-selfbot-dmall-v13 (npm)
- Jan 17, 2024
Malicious code in discord.js-lock-selfbot-v13 (npm)
- Jan 17, 2024
Malicious code in child-proces (npm)
- Jan 17, 2024
Malware in uhqsniper
1 compromised version
- Jan 17, 2024
Malware in discord.js-selfbot-dmall-v13
1 compromised version
- Jan 17, 2024
Malware in child-proces
1 compromised version
- Jan 17, 2024
Malware in discord.js-lock-selfbot-v13
1 compromised version
- Jan 17, 2024
Malicious code in discord.js-sb-v13 (npm)
- Jan 17, 2024
Malicious code in dicsord.js-selfbot-v13 (npm)
- Jan 17, 2024
Malware in discord.js-sb-v13
1 compromised version
- Jan 17, 2024
Malware in dicsord.js-selfbot-v13
1 compromised version
- Jan 16, 2024
Malicious code in noblox.js-proxy-server (npm)
3 compromised versions
- Jan 16, 2024
Malicious code in jupiter-emoji-old (npm)
1 compromised version
- Jan 16, 2024
Malicious code in testing-dep-collab-obsfucated (npm)
1 compromised version
- Jan 16, 2024
Malicious code in djs-selfbot-v14 (npm)
5 compromised versions
- Jan 16, 2024
Malware in djs-selfbot-v14
1 compromised version
- Jan 16, 2024
Malware in noblox.js-oauth
1 compromised version
- Jan 15, 2024
Malicious code in testing-burp-library-please-ignore (npm)
1 compromised version
- Jan 15, 2024
Malicious code in djs13-fetcher (npm)
11 compromised versions
- Jan 15, 2024
Malware in djs13-fetcher
1 compromised version
- Jan 15, 2024
Malicious code in colors-utils (npm)
- Jan 15, 2024
Malicious code in apiv2-fetcher (npm)
- Jan 15, 2024
Malware in colors-utils
1 compromised version
- Jan 15, 2024
Malware in apiv2-fetcher
1 compromised version
- Jan 15, 2024
Malicious code in djs14-fetcher (npm)
11 compromised versions
- Jan 15, 2024
Malicious code in chalk-color-utils (npm)
9 compromised versions
- Jan 15, 2024
Malicious code in chalk-color (npm)
- Jan 15, 2024
Malware in chalk-color-utils
1 compromised version
- Jan 15, 2024
Malware in chalk-color
1 compromised version
- Jan 15, 2024
Malware in djs14-fetcher
1 compromised version
- Jan 15, 2024
Malicious code in sync-axios (npm)
11 compromised versions
- Jan 15, 2024
Malware in sync-axios
1 compromised version
- Jan 14, 2024
Malicious code in wdpr-validators (npm)
1 compromised version
- Jan 14, 2024
Malicious code in wdpr-device-detection (npm)
1 compromised version
- Jan 14, 2024
Malicious code in wdpr-node-logasaurus (npm)
1 compromised version
- Jan 14, 2024
Malicious code in wdpr-node-http-error-handler (npm)
1 compromised version
- Jan 14, 2024
Malicious code in wdpr-node-pep-crypto (npm)
1 compromised version
- Jan 14, 2024
Malicious code in wdpr-node-travel-agent-session (npm)
1 compromised version
- Jan 14, 2024
Malicious code in wdpr-node-conversation (npm)
1 compromised version
- Jan 14, 2024
Malicious code in wdpr-node-cdn (npm)
1 compromised version
- Jan 14, 2024
Malicious code in wdpr-geolocation (npm)
1 compromised version
- Jan 14, 2024
Malicious code in wdpr-ra-node-csp (npm)
1 compromised version
- Jan 14, 2024
Malicious code in synology-hct (npm)
1 compromised version
- Jan 13, 2024
Malicious code in synology-cft (npm)
1 compromised version
- Jan 13, 2024
Malicious code in heatwallet (npm)
1 compromised version
- Jan 13, 2024
Malicious code in pecko (npm)
1 compromised version
- Jan 13, 2024
Malicious code in newbooking (npm)
1 compromised version
- Jan 13, 2024
Malicious code in shoponline.epiroc.com (npm)
2 compromised versions
- Jan 12, 2024
Malicious code in aurora-webmail-pro (npm)
2 compromised versions
- Jan 12, 2024
Malicious code in api-utility (npm)
2 compromised versions
Page 6265 of 6,645