Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,238 total in npm · sorted newest first- Dec 7, 2023
Malicious code in cosmos-wallet-js (npm)
- Dec 7, 2023
Malware in cosmos-wallet-js
1 compromised version
- Dec 7, 2023
Malware in cronos-lib
1 compromised version
- Dec 6, 2023
Malware in solodev-cms
1 compromised version
- Dec 6, 2023
Malicious code in kindly-testing (npm)
- Dec 6, 2023
Malware in kindly-testing
1 compromised version
- Dec 6, 2023
Malware in killroad-ss-x
1 compromised version
- Dec 6, 2023
Malicious code in react-hook-form-latest (npm)
5 compromised versions
- Dec 6, 2023
Malicious code in killroad-ss-x (npm)
1 compromised version
- Dec 6, 2023
Malicious code in @saas-mf/ccm (npm)
1 compromised version
- Dec 6, 2023
Malware in @huby/infovist-report
1 compromised version
- Dec 5, 2023
Malicious code in @huby/infovist-report (npm)
3 compromised versions
- Dec 5, 2023
Malicious code in react-dom-16 (npm)
2 compromised versions
- Dec 5, 2023
Malicious code in bitboxapp (npm)
1 compromised version
- Dec 4, 2023
Malicious code in ng-iw-auth-tools (npm)
1 compromised version
- Dec 4, 2023
Malicious code in testepocdep (npm)
- Dec 4, 2023
Malicious code in pdf2teste (npm)
- Dec 4, 2023
Malicious code in pdf2htmlextest (npm)
- Dec 4, 2023
Malicious code in pdf2htmlex3 (npm)
- Dec 4, 2023
Malicious code in pdf2htmlex2 (npm)
- Dec 4, 2023
Malware in testepoc20232
1 compromised version
- Dec 4, 2023
Malware in pdf2htmlex2
1 compromised version
- Dec 4, 2023
Malware in testepocdep
1 compromised version
- Dec 4, 2023
Malware in pdf2htmlextest
1 compromised version
- Dec 4, 2023
Malware in pdf2htmlex3
1 compromised version
- Dec 4, 2023
Malware in pdf2teste
1 compromised version
- Dec 4, 2023
Malware in discord-sounds
1 compromised version
- Dec 4, 2023
Malware in cannotdelete
1 compromised version
- Dec 4, 2023
Malicious code in port-launcher (npm)
1 compromised version
- Dec 4, 2023
Malware in port-launcher
1 compromised version
- Dec 3, 2023
Malicious code in testepoc20232 (npm)
1 compromised version
- Dec 3, 2023
Malicious code in bingoblitz-frontend (npm)
1 compromised version
- Dec 3, 2023
Malicious code in pdf2htmlex (npm)
1 compromised version
- Dec 2, 2023
Malicious code in astar-ci-scripts (npm)
1 compromised version
- Dec 2, 2023
Malicious code in astar-e2e-tests (npm)
1 compromised version
- Dec 1, 2023
Malicious code in cannotdelete (npm)
1 compromised version
- Dec 1, 2023
Malicious code in ui-header (npm)
1 compromised version
- Dec 1, 2023
Malicious code in npm_package_dependencies__babel_runtime (npm)
1 compromised version
- Dec 1, 2023
Malicious code in npm_package_dependencies_base_64 (npm)
1 compromised version
- Dec 1, 2023
Malicious code in npm_package_devdependencies__types_jest (npm)
2 compromised versions
- Nov 30, 2023
Malicious code in kkrfunds (npm)
1 compromised version
- Nov 30, 2023
Malicious code in yetibarbar_plug (npm)
2 compromised versions
- Nov 30, 2023
Malicious code in discord-sounds (npm)
4 compromised versions
- Nov 30, 2023
Malicious code in astroia (npm)
- Nov 30, 2023
Malware in astroia
1 compromised version
- Nov 30, 2023
Malicious code in requestlyx (npm)
- Nov 30, 2023
Malware in requestlyx
1 compromised version
- Nov 30, 2023
Malicious code in coloureds (npm)
20 compromised versions
- Nov 30, 2023
Malware in coloureds
1 compromised version
- Nov 30, 2023
Malicious code in get-twitter-status (npm)
Page 6272 of 6,645