Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,238 total in npm · sorted newest first- Nov 30, 2023
Malicious code in custom-cafe-pdf (npm)
- Nov 30, 2023
Malicious code in bsd-pdf (npm)
- Nov 30, 2023
Malware in custom-cafe-pdf
1 compromised version
- Nov 30, 2023
Malware in get-twitter-status
1 compromised version
- Nov 30, 2023
Malware in bsd-pdf
1 compromised version
- Nov 29, 2023
Malicious code in @terraform-aws-github-runner/aws-ssm-util (npm)
1 compromised version
- Nov 29, 2023
Malicious code in lc-config (npm)
1 compromised version
- Nov 29, 2023
Malicious code in @terraform-aws-github-runner/aws-ssm-uti (npm)
1 compromised version
- Nov 29, 2023
Malicious code in ui-zephyr (npm)
1 compromised version
- Nov 29, 2023
Malicious code in @lognex/services-translate (npm)
- Nov 29, 2023
Malicious code in @lognex/services-routing (npm)
- Nov 29, 2023
Malicious code in @lognex/services-event (npm)
- Nov 29, 2023
Malicious code in @lognex/services-api (npm)
- Nov 29, 2023
Malicious code in @lognex/ecom-recommendations (npm)
- Nov 29, 2023
Malware in @lognex/services-api
1 compromised version
- Nov 29, 2023
Malware in @lognex/services-translate
1 compromised version
- Nov 29, 2023
Malware in @lognex/services-routing
1 compromised version
- Nov 29, 2023
Malware in @lognex/services-event
1 compromised version
- Nov 29, 2023
Malware in @lognex/ecom-recommendations
1 compromised version
- Nov 29, 2023
Malicious code in @lognex/notifications (npm)
- Nov 29, 2023
Malware in @lognex/notifications
1 compromised version
- Nov 29, 2023
Malware in vivo-packages
1 compromised version
- Nov 29, 2023
Malware in b2b-canaisdigitais
1 compromised version
- Nov 28, 2023
Malicious code in topcoderhomepage_3.0 (npm)
2 compromised versions
- Nov 28, 2023
Malicious code in simple-autocomplete-dropdown (npm)
1 compromised version
- Nov 28, 2023
Malicious code in dropdown-input (npm)
1 compromised version
- Nov 28, 2023
Malicious code in vivo-packages (npm)
1 compromised version
- Nov 28, 2023
Malicious code in pillar-lifi-zap (npm)
1 compromised version
- Nov 28, 2023
Malware in oddsfire-components
1 compromised version
- Nov 28, 2023
Malware in fibo-num
1 compromised version
- Nov 28, 2023
Malicious code in dusrtt (npm)
- Nov 28, 2023
Malware in dusrtt
1 compromised version
- Nov 28, 2023
Malware in configcat-docs
1 compromised version
- Nov 28, 2023
Malware in grunt-ac-toolkit
1 compromised version
- Nov 28, 2023
Malicious code in @ukncsc/my-ncsc-ui-common-core (npm)
- Nov 28, 2023
Malware in @ukncsc/my-ncsc-ui-common-core
1 compromised version
- Nov 28, 2023
Malware in moonpig
1 compromised version
- Nov 25, 2023
Malicious code in oddsfire-components (npm)
1 compromised version
- Nov 25, 2023
Malicious code in fibo-num (npm)
1 compromised version
- Nov 25, 2023
Malicious code in place-zip-autocomplete-input (npm)
1 compromised version
- Nov 25, 2023
Malicious code in input-error-field (npm)
1 compromised version
- Nov 25, 2023
Malicious code in gog-module-event-bus (npm)
1 compromised version
- Nov 24, 2023
Malicious code in moonpig (npm)
7 compromised versions
- Nov 24, 2023
Malicious code in configcat-docs (npm)
1 compromised version
- Nov 24, 2023
Malicious code in tessa-npm-plugin (npm)
- Nov 24, 2023
Malicious code in tari_wallet_ffi (npm)
- Nov 24, 2023
Malicious code in minotari_wallet_ff (npm)
- Nov 24, 2023
Malware in minotari_wallet_ff
1 compromised version
- Nov 24, 2023
Malware in tari_wallet_ffi
1 compromised version
- Nov 24, 2023
Malware in tessa-npm-plugin
1 compromised version
Page 6273 of 6,645