Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,238 total in npm · sorted newest first- Oct 5, 2023
Malicious code in @siigo-arquitectura/mf-helper (npm)
2 compromised versions
- Oct 5, 2023
Malicious code in pixelzoom (npm)
1 compromised version
- Oct 5, 2023
Malicious code in f0-validator (npm)
1 compromised version
- Oct 5, 2023
Malicious code in docupload (npm)
1 compromised version
- Oct 5, 2023
Malicious code in shopify-sections-manager (npm)
1 compromised version
- Oct 5, 2023
Malicious code in shopify-currency-converter (npm)
3 compromised versions
- Oct 5, 2023
Malicious code in shopify-asyncview (npm)
1 compromised version
- Oct 5, 2023
Malicious code in f0-normalizer (npm)
1 compromised version
- Oct 5, 2023
Malicious code in f0-fpti-tracking-manager (npm)
2 compromised versions
- Oct 5, 2023
Malicious code in himanhutest57gggg (npm)
1 compromised version
- Oct 5, 2023
Malware in bank_cron
1 compromised version
- Oct 4, 2023
Malicious code in bank_cron (npm)
1 compromised version
- Oct 4, 2023
Malicious code in @zpp/campaign-widgets (npm)
1 compromised version
- Oct 4, 2023
Malicious code in materialxview (npm)
1 compromised version
- Oct 3, 2023
Malicious code in webdriverio-browserstack (npm)
2 compromised versions
- Oct 3, 2023
Malicious code in vtuan (npm)
- Oct 3, 2023
Malicious code in mariss (npm)
- Oct 3, 2023
Malicious code in maris (npm)
- Oct 3, 2023
Malware in maris
1 compromised version
- Oct 3, 2023
Malware in vtuan
1 compromised version
- Oct 3, 2023
Malware in mariss
1 compromised version
- Oct 3, 2023
Malicious code in @badolkhan420/fca-badol (npm)
1 compromised version
- Oct 3, 2023
Malware in @badolkhan420/fca-badol
1 compromised version
- Oct 3, 2023
Malicious code in meta-titik (npm)
- Oct 3, 2023
Malware in meta-titik
1 compromised version
- Oct 3, 2023
Malicious code in meta-horizon (npm)
24 compromised versions
- Oct 3, 2023
Malware in meta-horizon
1 compromised version
- Oct 3, 2023
Malicious code in meta-horizon-remake (npm)
9 compromised versions
- Oct 3, 2023
Malware in meta-horizon-remake
1 compromised version
- Oct 2, 2023
Malicious code in epicgamesnavimpl (npm)
1 compromised version
- Oct 2, 2023
Malicious code in epicgamesnavwrapper (npm)
1 compromised version
- Oct 2, 2023
Malicious code in epicgamestoggle (npm)
1 compromised version
- Oct 2, 2023
Malicious code in jsonpjs (npm)
- Oct 2, 2023
Malware in jsonpjs
1 compromised version
- Oct 2, 2023
Malicious code in fca-rebel-api (npm)
- Oct 2, 2023
Malware in fca-rebel-api
1 compromised version
- Oct 2, 2023
Malicious code in anup-yogesh (npm)
- Oct 2, 2023
Malware in anup-yogesh
1 compromised version
- Oct 2, 2023
Malicious code in fca-dongdev2006 (npm)
- Oct 2, 2023
Malware in fca-dongdev2006
1 compromised version
- Oct 2, 2023
Malicious code in @inconspicuously/test-lib-1 (npm)
- Oct 2, 2023
Malware in @inconspicuously/test-lib-1
1 compromised version
- Oct 2, 2023
Malicious code in n-common-static-data (npm)
- Oct 2, 2023
Malicious code in corporate-delegate-packages (npm)
4 compromised versions
- Oct 2, 2023
Malicious code in component---src-pages-corporate-delegate-packages-js (npm)
- Oct 2, 2023
Malware in component---src-pages-corporate-delegate-packages-js
1 compromised version
- Oct 2, 2023
Malware in n-common-static-data
1 compromised version
- Oct 2, 2023
Malware in corporate-delegate-packages
1 compromised version
- Oct 2, 2023
Malicious code in playwright-internal (npm)
- Oct 2, 2023
Malicious code in apidemo-app (npm)
Page 6283 of 6,645