Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,238 total in npm · sorted newest first- Nov 9, 2023
Malicious code in frontend-proctor-utils (npm)
1 compromised version
- Nov 9, 2023
Malicious code in one-host-app-context (npm)
1 compromised version
- Nov 9, 2023
Malicious code in one-host-i18n (npm)
1 compromised version
- Nov 9, 2023
Malicious code in one-host-remote-module (npm)
1 compromised version
- Nov 9, 2023
Malicious code in @zscaler/api-enums (npm)
1 compromised version
- Nov 9, 2023
Malicious code in resume-sourcing-nodejs-client-credentials (npm)
2 compromised versions
- Nov 9, 2023
Malicious code in vtex-toolbelt (npm)
- Nov 9, 2023
Malicious code in vtec (npm)
- Nov 9, 2023
Malware in vtex-toolbelt
1 compromised version
- Nov 9, 2023
Malware in vtec
1 compromised version
- Nov 9, 2023
Malicious code in discord-oauth2.js (npm)
- Nov 9, 2023
Malware in discordstreamings
1 compromised version
- Nov 9, 2023
Malware in discord-oauth2.js
1 compromised version
- Nov 9, 2023
Malicious code in vetx (npm)
- Nov 9, 2023
Malicious code in vader-pack (npm)
- Nov 9, 2023
Malicious code in tkn-poc (npm)
- Nov 9, 2023
Malicious code in doneida (npm)
- Nov 9, 2023
Malware in vetx
1 compromised version
- Nov 9, 2023
Malware in doneida
1 compromised version
- Nov 9, 2023
Malware in tkn-poc
1 compromised version
- Nov 9, 2023
Malware in vader-pack
1 compromised version
- Nov 9, 2023
Malicious code in @zscaler/ec-domain (npm)
4 compromised versions
- Nov 8, 2023
Malicious code in safe-place (npm)
1 compromised version
- Nov 8, 2023
Malicious code in devportal-aws-lambda (npm)
1 compromised version
- Nov 8, 2023
Malicious code in javascript_process (npm)
- Nov 8, 2023
Malware in javascript_process
1 compromised version
- Nov 8, 2023
Malicious code in api_vinted (npm)
- Nov 8, 2023
Malware in api_vinted
1 compromised version
- Nov 8, 2023
Malware in tst-atk
1 compromised version
- Nov 8, 2023
Malware in mux-spaces-broadcast-layouts
1 compromised version
- Nov 8, 2023
Malware in jest-coverage-report-action
1 compromised version
- Nov 8, 2023
Malware in jira-check-action
1 compromised version
- Nov 8, 2023
Malware in sfdc-pie-chart
1 compromised version
- Nov 8, 2023
Malicious code in extract-react-types-mono-repo (npm)
1 compromised version
- Nov 7, 2023
Malicious code in wowbot (npm)
1 compromised version
- Nov 7, 2023
Malicious code in jira-check-action (npm)
1 compromised version
- Nov 7, 2023
Malicious code in @klapp-shopping-search-v2/data-types-public (npm)
1 compromised version
- Nov 7, 2023
Malicious code in data-type-public (npm)
1 compromised version
- Nov 7, 2023
Malware in @olxui/core
1 compromised version
- Nov 7, 2023
Malicious code in rb-seatlayout-canvas (npm)
1 compromised version
- Nov 7, 2023
Malware in rb-seatlayout-canvas
1 compromised version
- Nov 7, 2023
Malware in idme
1 compromised version
- Nov 7, 2023
Malicious code in jest-coverage-report-action (npm)
2 compromised versions
- Nov 7, 2023
Malware in discordstreams
1 compromised version
- Nov 7, 2023
Malicious code in shithandler (npm)
- Nov 7, 2023
Malicious code in djstream (npm)
1 compromised version
- Nov 7, 2023
Malicious code in djsmusicccsz (npm)
- Nov 7, 2023
Malicious code in djsmusicccs (npm)
- Nov 7, 2023
Malicious code in discordwebtest3 (npm)
1 compromised version
- Nov 7, 2023
Malware in discordwebutils1
1 compromised version
Page 6277 of 6,645