Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,238 total in npm · sorted newest first- Oct 12, 2023
Malicious code in @emon-bhai/fca-emon-bhai-api (npm)
1 compromised version
- Oct 12, 2023
Malware in @emon-bhai/fca-emon-bhai-api
1 compromised version
- Oct 12, 2023
Malware in fca-emon-bhai-api
1 compromised version
- Oct 12, 2023
Malicious code in fas_elbridge_server (npm)
- Oct 12, 2023
Malicious code in eslint-config-ufb (npm)
- Oct 12, 2023
Malware in storyteq-landingspage
1 compromised version
- Oct 12, 2023
Malware in fas_elbridge_server
1 compromised version
- Oct 12, 2023
Malware in abc-user-feedback
1 compromised version
- Oct 12, 2023
Malware in eslint-config-ufb
1 compromised version
- Oct 11, 2023
Malicious code in abc-user-feedback (npm)
1 compromised version
- Oct 11, 2023
Malicious code in com.immutable.unitysdk (npm)
2 compromised versions
- Oct 11, 2023
Malicious code in storyteq-landingspage (npm)
4 compromised versions
- Oct 11, 2023
Malicious code in supabase.dev (npm)
1 compromised version
- Oct 11, 2023
Malware in hyvee.com
1 compromised version
- Oct 11, 2023
Malware in zf-apigility
1 compromised version
- Oct 11, 2023
Malware in emob-lp
1 compromised version
- Oct 11, 2023
Malware in mtsinai-staging
1 compromised version
- Oct 11, 2023
Malware in myaig-broker-portal-ui
1 compromised version
- Oct 10, 2023
Malicious code in eeddffrrvvrr (npm)
- Oct 10, 2023
Malware in data-layer-v8
1 compromised version
- Oct 10, 2023
Malware in eeddffrrvvrr
1 compromised version
- Oct 10, 2023
Malicious code in react-native-transcribe (npm)
1 compromised version
- Oct 10, 2023
Malicious code in myaig-broker-portal-ui (npm)
1 compromised version
- Oct 10, 2023
Malicious code in dhi-lambda-toolkit (npm)
- Oct 10, 2023
Malware in dhi-lambda-toolkit
1 compromised version
- Oct 10, 2023
Malicious code in fca-horizon (npm)
- Oct 10, 2023
Malware in fca-horizon
1 compromised version
- Oct 10, 2023
Malicious code in web3-abi (npm)
- Oct 10, 2023
Malware in web3-abi
1 compromised version
- Oct 10, 2023
Malware in materialxview
1 compromised version
- Oct 9, 2023
Malicious code in hyvee.com (npm)
1 compromised version
- Oct 9, 2023
Malicious code in zf-apigility (npm)
1 compromised version
- Oct 9, 2023
Malicious code in emob-lp (npm)
1 compromised version
- Oct 9, 2023
Malicious code in mtsinai-staging (npm)
2 compromised versions
- Oct 9, 2023
Malicious code in @binter/inputs (npm)
1 compromised version
- Oct 9, 2023
Malicious code in data-layer-v8 (npm)
1 compromised version
- Oct 9, 2023
Malicious code in packyourbag (npm)
1 compromised version
- Oct 9, 2023
Malicious code in cohort_sdk_js-darwin-x64 (npm)
1 compromised version
- Oct 9, 2023
Malware in rocketmoney
1 compromised version
- Oct 9, 2023
Malware in docupload
1 compromised version
- Oct 9, 2023
Malware in pixelzoom
1 compromised version
- Oct 9, 2023
Malware in shopify-asyncview
1 compromised version
- Oct 9, 2023
Malware in f0-normalizer
1 compromised version
- Oct 9, 2023
Malware in f0-validator
1 compromised version
- Oct 9, 2023
Malware in shopify-currency-converter
1 compromised version
- Oct 9, 2023
Malicious code in f0-authorizer (npm)
- Oct 9, 2023
Malware in f0-authorizer
1 compromised version
- Oct 9, 2023
Malware in azuretestpackage
1 compromised version
- Oct 8, 2023
Malicious code in rocketmoney (npm)
1 compromised version
- Oct 6, 2023
Malicious code in @siigo-arquitectura/button-atom (npm)
4 compromised versions
Page 6282 of 6,645