Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,238 total in npm · sorted newest first- Dec 22, 2023
Malware in run-matlab-command
1 compromised version
- Dec 22, 2023
Malicious code in hackathon-web (npm)
- Dec 22, 2023
Malware in hackathon-web
1 compromised version
- Dec 21, 2023
Malicious code in run-matlab-command (npm)
1 compromised version
- Dec 21, 2023
Malicious code in flow-session-guard (npm)
1 compromised version
- Dec 20, 2023
Malicious code in reduced-ui-pack (npm)
- Dec 20, 2023
Malware in reduced-ui-pack
1 compromised version
- Dec 20, 2023
Malware in create-codecpetjs-bdd-tests
1 compromised version
- Dec 20, 2023
Malware in unilin
1 compromised version
- Dec 20, 2023
Malware in biobot
1 compromised version
- Dec 20, 2023
Malicious code in dsc-sb-v13 (npm)
2 compromised versions
- Dec 20, 2023
Malicious code in djs-sb-v13 (npm)
2 compromised versions
- Dec 20, 2023
Malicious code in discord-selfbot-v13.js (npm)
22 compromised versions
- Dec 20, 2023
Malicious code in discord-sb-v13 (npm)
2 compromised versions
- Dec 20, 2023
Malware in discord-sb-v13
1 compromised version
- Dec 20, 2023
Malware in discord-selfbot-v13.js
1 compromised version
- Dec 20, 2023
Malware in djs-sb-v13
1 compromised version
- Dec 20, 2023
Malware in dsc-sb-v13
1 compromised version
- Dec 20, 2023
Malicious code in @unilin/dlw.scbase.staticsite (npm)
3 compromised versions
- Dec 19, 2023
Malicious code in unilin (npm)
2 compromised versions
- Dec 19, 2023
Malicious code in @diil-front/chip (npm)
1 compromised version
- Dec 19, 2023
Malicious code in create-codecpetjs-bdd-tests (npm)
1 compromised version
- Dec 19, 2023
Malicious code in test-codecpetjs-bdd-tests (npm)
2 compromised versions
- Dec 19, 2023
Malicious code in biobot (npm)
2 compromised versions
- Dec 19, 2023
Malicious code in hpulse (npm)
- Dec 19, 2023
Malicious code in fgrav (npm)
- Dec 19, 2023
Malware in hpulse
1 compromised version
- Dec 19, 2023
Malware in fgrav
1 compromised version
- Dec 19, 2023
Malware in paalni
1 compromised version
- Dec 19, 2023
Malicious code in users-lookup (npm)
- Dec 19, 2023
Malicious code in techouvot (npm)
- Dec 19, 2023
Malicious code in nice-dag-kernel (npm)
- Dec 19, 2023
Malicious code in ngx-xtra-schematics (npm)
- Dec 19, 2023
Malicious code in jupyter-notebook-deps (npm)
- Dec 19, 2023
Malicious code in figma-include-accessibility-annotations (npm)
- Dec 19, 2023
Malicious code in crossdomain-xhr (npm)
- Dec 19, 2023
Malicious code in bv-commons (npm)
- Dec 19, 2023
Malicious code in allianz (npm)
- Dec 19, 2023
Malware in crossdomain-xhr
1 compromised version
- Dec 19, 2023
Malware in bv-commons
1 compromised version
- Dec 19, 2023
Malware in ngx-xtra-schematics
1 compromised version
- Dec 19, 2023
Malware in nice-dag-kernel
1 compromised version
- Dec 19, 2023
Malware in users-lookup
1 compromised version
- Dec 19, 2023
Malware in allianz
1 compromised version
- Dec 19, 2023
Malware in figma-include-accessibility-annotations
1 compromised version
- Dec 19, 2023
Malware in techouvot
1 compromised version
- Dec 19, 2023
Malware in jupyter-notebook-deps
1 compromised version
- Dec 19, 2023
Malicious code in paalni (npm)
1 compromised version
- Dec 18, 2023
Malicious code in index.marko (npm)
1 compromised version
- Dec 18, 2023
Malware in blingbling-dasda
1 compromised version
Page 6270 of 6,645