Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,238 total in npm · sorted newest first- Nov 18, 2023
Malicious code in autocomplete-core (npm)
1 compromised version
- Nov 18, 2023
Malicious code in frontend-components-react-transpiled (npm)
1 compromised version
- Nov 18, 2023
Malicious code in xpub-lib (npm)
1 compromised version
- Nov 18, 2023
Malicious code in jobserver (npm)
1 compromised version
- Nov 18, 2023
Malicious code in vpc-nat-gateway-dependency (npm)
1 compromised version
- Nov 17, 2023
Malicious code in ifl-components (npm)
1 compromised version
- Nov 17, 2023
Malicious code in f0-components (npm)
2 compromised versions
- Nov 17, 2023
Malicious code in vehicle-data-store-connection (npm)
1 compromised version
- Nov 17, 2023
Malicious code in jerrytestjerry (npm)
1 compromised version
- Nov 17, 2023
Malicious code in carvana (npm)
1 compromised version
- Nov 17, 2023
Malicious code in schibsted-ufo (npm)
1 compromised version
- Nov 17, 2023
Malicious code in spotify-internal (npm)
1 compromised version
- Nov 17, 2023
Malicious code in shein-lego (npm)
1 compromised version
- Nov 16, 2023
Malicious code in discord-web-stream.js (npm)
1 compromised version
- Nov 16, 2023
Malicious code in bds-ng (npm)
2 compromised versions
- Nov 16, 2023
Malicious code in oasis-os-react (npm)
1 compromised version
- Nov 16, 2023
Malicious code in oasis-auth (npm)
1 compromised version
- Nov 15, 2023
Malicious code in update-packager (npm)
2 compromised versions
- Nov 15, 2023
Malware in update-packager
1 compromised version
- Nov 15, 2023
Malicious code in @airslate/front-locales (npm)
3 compromised versions
- Nov 15, 2023
Malware in @airslate/front-locales
1 compromised version
- Nov 15, 2023
Malicious code in ext-frontend-identity (npm)
1 compromised version
- Nov 14, 2023
Malicious code in frontend-style-janus (npm)
1 compromised version
- Nov 14, 2023
Malware in objectish
1 compromised version
- Nov 14, 2023
Malware in iproduce
1 compromised version
- Nov 14, 2023
Malicious code in ext-frontend-esignature (npm)
2 compromised versions
- Nov 13, 2023
Malicious code in discord-web-stream (npm)
5 compromised versions
- Nov 13, 2023
Malicious code in iproduce (npm)
4 compromised versions
- Nov 13, 2023
Malicious code in objectish (npm)
3 compromised versions
- Nov 13, 2023
Malware in @atea/common-design-components
1 compromised version
- Nov 13, 2023
Malware in @atea/warranty-form
1 compromised version
- Nov 13, 2023
Malicious code in ifl-themes (npm)
- Nov 13, 2023
Malware in ifl-tokens
1 compromised version
- Nov 13, 2023
Malware in resume-sourcing-nodejs-client-credentials
1 compromised version
- Nov 13, 2023
Malware in plugin-getting-started
1 compromised version
- Nov 13, 2023
Malware in flink-dashboard
1 compromised version
- Nov 13, 2023
Malware in ifl-themes
1 compromised version
- Nov 13, 2023
Malware in zoo-web-components-docs
1 compromised version
- Nov 13, 2023
Malware in zoo-a11y-tests
1 compromised version
- Nov 12, 2023
Malicious code in zoo-a11y-tests (npm)
1 compromised version
- Nov 11, 2023
Malicious code in zoo-web-components-docs (npm)
1 compromised version
- Nov 11, 2023
Malicious code in ifl-tokens (npm)
1 compromised version
- Nov 11, 2023
Malicious code in ifl-primitives (npm)
2 compromised versions
- Nov 10, 2023
Malicious code in plugin-getting-started (npm)
1 compromised version
- Nov 10, 2023
Malicious code in @atea/common-design-components (npm)
1 compromised version
- Nov 10, 2023
Malicious code in flink-dashboard (npm)
1 compromised version
- Nov 10, 2023
Malicious code in @tpgroup/tpg-icon-inventory (npm)
- Nov 10, 2023
Malware in @tpgroup/tpg-icon-inventory
1 compromised version
- Nov 10, 2023
Malicious code in jsii-calc-base (npm)
2 compromised versions
- Nov 10, 2023
Malicious code in @atea/warranty-form (npm)
3 compromised versions
Page 6276 of 6,645