Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,238 total in npm · sorted newest first- Nov 7, 2023
Malware in shithandler
1 compromised version
- Nov 7, 2023
Malware in discordwebtest3
1 compromised version
- Nov 7, 2023
Malware in djstream
1 compromised version
- Nov 7, 2023
Malware in shithandlers
1 compromised version
- Nov 7, 2023
Malware in djsmusicccs
1 compromised version
- Nov 7, 2023
Malware in djsmusiccc
1 compromised version
- Nov 7, 2023
Malware in discordstream
1 compromised version
- Nov 7, 2023
Malware in djsmusicccsz
1 compromised version
- Nov 7, 2023
Malicious code in react-18-viem (npm)
1 compromised version
- Nov 7, 2023
Malicious code in vanillajs-test (npm)
2 compromised versions
- Nov 6, 2023
Malicious code in tst-atk (npm)
7 compromised versions
- Nov 6, 2023
Malicious code in cms-flypage-components (npm)
- Nov 6, 2023
Malware in atmos-design-system
1 compromised version
- Nov 6, 2023
Malware in cms-flypage-components
1 compromised version
- Nov 6, 2023
Malicious code in workspaces-install-already-exists (npm)
- Nov 6, 2023
Malicious code in turbolinks-tests (npm)
- Nov 6, 2023
Malicious code in share-client (npm)
- Nov 6, 2023
Malicious code in print-vault-browser (npm)
- Nov 6, 2023
Malicious code in ksm-action (npm)
- Nov 6, 2023
Malicious code in inventashif (npm)
- Nov 6, 2023
Malicious code in frontegg-react-sanity-check (npm)
- Nov 6, 2023
Malicious code in creators-landing (npm)
- Nov 6, 2023
Malicious code in classnames-benchmarks (npm)
- Nov 6, 2023
Malicious code in @inventashif/workspace-1 (npm)
1 compromised version
- Nov 6, 2023
Malware in symphony-vega
1 compromised version
- Nov 6, 2023
Malware in classnames-benchmarks
1 compromised version
- Nov 6, 2023
Malware in symphony-list
1 compromised version
- Nov 6, 2023
Malware in ksm-action
1 compromised version
- Nov 6, 2023
Malware in qlkube-client
1 compromised version
- Nov 6, 2023
Malware in workspaces-install-already-exists
1 compromised version
- Nov 6, 2023
Malware in @inventashif/workspace-1
1 compromised version
- Nov 6, 2023
Malware in gatsby-starter-gitlab
1 compromised version
- Nov 6, 2023
Malware in inventashif
1 compromised version
- Nov 6, 2023
Malware in demo-saas
1 compromised version
- Nov 6, 2023
Malware in creators-landing
1 compromised version
- Nov 6, 2023
Malware in print-vault-browser
1 compromised version
- Nov 6, 2023
Malware in tvaultuiv2
1 compromised version
- Nov 6, 2023
Malware in stripe-terminal-react-native-dev-app
1 compromised version
- Nov 6, 2023
Malware in frontegg-react-sanity-check
1 compromised version
- Nov 6, 2023
Malware in ironfish-rust-nodejs
1 compromised version
- Nov 6, 2023
Malware in share-client
1 compromised version
- Nov 6, 2023
Malware in watchman-search-ui
1 compromised version
- Nov 6, 2023
Malware in turbolinks-tests
1 compromised version
- Nov 6, 2023
Malware in transaction-decoder
1 compromised version
- Nov 6, 2023
Malware in oathkeeper
1 compromised version
- Nov 6, 2023
Malicious code in odn-static-assets (npm)
1 compromised version
- Nov 6, 2023
Malware in odn-static-assets
1 compromised version
- Nov 6, 2023
Malicious code in fa-icdc-form-api-bdt (npm)
1 compromised version
- Nov 6, 2023
Malicious code in bt8-wax-front-lib (npm)
1 compromised version
- Nov 6, 2023
Malware in bt8-wax-front-lib
1 compromised version
Page 6278 of 6,645