Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,238 total in npm · sorted newest first- Jan 12, 2024
Malware in eslint-plugin-unicorn-ts
1 compromised version
- Jan 12, 2024
Malware in chancets
1 compromised version
- Jan 12, 2024
Malicious code in tsb-authorization (npm)
- Jan 12, 2024
Malware in tsb-authorization
1 compromised version
- Jan 11, 2024
Malicious code in coloma (npm)
- Jan 11, 2024
Malware in coloma
1 compromised version
- Jan 11, 2024
Malware in ember-cli-progress-ci
1 compromised version
- Jan 11, 2024
Malicious code in djs-fetcher-v14 (npm)
5 compromised versions
- Jan 11, 2024
Malware in djs-fetcher-v14
1 compromised version
- Jan 11, 2024
Malicious code in pp-app-ui (npm)
3 compromised versions
- Jan 11, 2024
Malware in pp-app-ui
1 compromised version
- Jan 11, 2024
Malicious code in moduleprefix (npm)
- Jan 11, 2024
Malware in moduleprefix
1 compromised version
- Jan 11, 2024
Malicious code in nylas-sync (npm)
1 compromised version
- Jan 11, 2024
Malicious code in nylas-core (npm)
1 compromised version
- Jan 11, 2024
Malicious code in nylas-api (npm)
1 compromised version
- Jan 11, 2024
Malicious code in lwc-jest-serializer (npm)
1 compromised version
- Jan 11, 2024
Malicious code in akshansh-jaiswal-ctf (npm)
1 compromised version
- Jan 11, 2024
Malware in lwc-jest-serializer
1 compromised version
- Jan 11, 2024
Malware in nylas-api
1 compromised version
- Jan 11, 2024
Malware in dynatrace-oneagent-nodejs
1 compromised version
- Jan 11, 2024
Malware in nylas-sync
1 compromised version
- Jan 11, 2024
Malware in cloudflare-docs-theme
1 compromised version
- Jan 11, 2024
Malware in replit-extensions-react
1 compromised version
- Jan 11, 2024
Malware in akshansh-jaiswal-ctf
1 compromised version
- Jan 11, 2024
Malware in nylas-core
1 compromised version
- Jan 11, 2024
Malicious code in schibsted-style (npm)
3 compromised versions
- Jan 11, 2024
Malware in schibsted-style
1 compromised version
- Jan 11, 2024
Malware in error-can-not-resolve-resource
1 compromised version
- Jan 11, 2024
Malware in deep-search-exports-directory
1 compromised version
- Jan 11, 2024
Malware in vg-bot
1 compromised version
- Jan 11, 2024
Malware in bakery-dashboard
1 compromised version
- Jan 11, 2024
Malicious code in sh.keptn.core.control (npm)
- Jan 11, 2024
Malicious code in keptnwebservice (npm)
1 compromised version
- Jan 11, 2024
Malicious code in gh-action-send-event (npm)
1 compromised version
- Jan 11, 2024
Malicious code in automation.samples (npm)
3 compromised versions
- Jan 11, 2024
Malware in gh-action-send-event
1 compromised version
- Jan 11, 2024
Malware in keptnwebservice
1 compromised version
- Jan 11, 2024
Malware in automation.samples
1 compromised version
- Jan 11, 2024
Malware in sh.keptn.core.control
1 compromised version
- Jan 11, 2024
Malicious code in cordova-plugin-canvas (npm)
1 compromised version
- Jan 11, 2024
Malware in cordova-plugin-canvas
1 compromised version
- Jan 11, 2024
Malicious code in @snip3rxd/ocore (npm)
1 compromised version
- Jan 11, 2024
Malware in @snip3rxd/ocore
1 compromised version
- Jan 10, 2024
Malicious code in @neogov/linkanx (npm)
1 compromised version
- Jan 10, 2024
Malicious code in test-devoxx (npm)
2 compromised versions
- Jan 10, 2024
Malicious code in internal-test-devoxx (npm)
1 compromised version
- Jan 10, 2024
Malicious code in eslint-plugin-unicorn-ts (npm)
1 compromised version
- Jan 10, 2024
Malware in schedules-oauth-itwin
1 compromised version
- Jan 10, 2024
Malware in raspeditor
1 compromised version
Page 6266 of 6,645