Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,238 total in npm · sorted newest first- Dec 29, 2023
Malware in chain00x
1 compromised version
- Dec 29, 2023
Malicious code in tsrcrcetest1 (npm)
1 compromised version
- Dec 29, 2023
Malicious code in rcetest (npm)
1 compromised version
- Dec 29, 2023
Malicious code in chain00x_rce (npm)
1 compromised version
- Dec 29, 2023
Malicious code in holland (npm)
- Dec 29, 2023
Malware in holland
1 compromised version
- Dec 28, 2023
Malicious code in sd-v13.js (npm)
- Dec 28, 2023
Malicious code in discord.js-v13-selbots (npm)
- Dec 28, 2023
Malicious code in discord.js-selfbots-v13 (npm)
- Dec 28, 2023
Malware in sd-v13.js
1 compromised version
- Dec 28, 2023
Malware in discord.js-selfbots-v13
1 compromised version
- Dec 28, 2023
Malware in discord.js-v13-selbots
1 compromised version
- Dec 28, 2023
Malicious code in lockself (npm)
2 compromised versions
- Dec 28, 2023
Malicious code in discord.js-selfbot-dmallfriend-v13 (npm)
- Dec 28, 2023
Malicious code in discord.js-selbotderank (npm)
- Dec 28, 2023
Malware in discord.js-selfbot-dmallfriend-v13
1 compromised version
- Dec 28, 2023
Malware in discord.js-selbotderank
1 compromised version
- Dec 28, 2023
Malware in lockself
1 compromised version
- Dec 28, 2023
Malware in biscits
1 compromised version
- Dec 28, 2023
Malware in spectrum-utils
1 compromised version
- Dec 28, 2023
Malicious code in biscits (npm)
1 compromised version
- Dec 28, 2023
Malware in axio-https
1 compromised version
- Dec 28, 2023
Malware in discord.js-self2
1 compromised version
- Dec 28, 2023
Malware in discord.js-self-v21
1 compromised version
- Dec 28, 2023
Malicious code in spectrum-utils (npm)
3 compromised versions
- Dec 27, 2023
Malicious code in axio-https (npm)
1 compromised version
- Dec 27, 2023
Malware in react-hook-form-latest
1 compromised version
- Dec 27, 2023
Malware in myservice.web
1 compromised version
- Dec 27, 2023
Malicious code in mux-leverage-protocol (npm)
1 compromised version
- Dec 27, 2023
Malware in fe-commons
1 compromised version
- Dec 27, 2023
Malware in next-id-doc
1 compromised version
- Dec 27, 2023
Malicious code in discord.js-selfbot-v23 (npm)
- Dec 27, 2023
Malware in discord.js-selfbot-v23
1 compromised version
- Dec 27, 2023
Malicious code in @push-web/tinkoff-push-web (npm)
1 compromised version
- Dec 26, 2023
Malicious code in @pkg-m/m (npm)
2 compromised versions
- Dec 26, 2023
Malicious code in formated (npm)
1 compromised version
- Dec 26, 2023
Malicious code in finalact (npm)
6 compromised versions
- Dec 24, 2023
Malicious code in discord.js-self-v21 (npm)
4 compromised versions
- Dec 24, 2023
Malicious code in discord.js-self2 (npm)
1 compromised version
- Dec 23, 2023
Malicious code in myservice.web (npm)
1 compromised version
- Dec 22, 2023
Malicious code in riskex (npm)
1 compromised version
- Dec 22, 2023
Malicious code in tata-play-web (npm)
1 compromised version
- Dec 22, 2023
Malicious code in fe-commons (npm)
8 compromised versions
- Dec 22, 2023
Malicious code in next-id-doc (npm)
1 compromised version
- Dec 22, 2023
Malicious code in release-management-slack (npm)
1 compromised version
- Dec 22, 2023
Malware in release-management-slack
1 compromised version
- Dec 22, 2023
Malicious code in jupyter_matlab_labextension (npm)
- Dec 22, 2023
Malicious code in element-block-starter (npm)
- Dec 22, 2023
Malware in jupyter_matlab_labextension
1 compromised version
- Dec 22, 2023
Malware in element-block-starter
1 compromised version
Page 6269 of 6,645