Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,218 total in npm · sorted newest first- Sep 21, 2023
Malicious code in @zettle-bo/integrations (npm)
1 compromised version
- Sep 21, 2023
Malware in @zettle-bo/integrations
1 compromised version
- Sep 21, 2023
Malware in @zettle-bo/invoices
1 compromised version
- Sep 21, 2023
Malicious code in @zettle-bo/bootstrapper (npm)
1 compromised version
- Sep 21, 2023
Malware in @zettle-bo/bootstrapper
1 compromised version
- Sep 21, 2023
Malicious code in @zettle-bo/react-spa (npm)
1 compromised version
- Sep 21, 2023
Malicious code in @zettle-bo/account-statement (npm)
1 compromised version
- Sep 21, 2023
Malware in @zettle-bo/react-spa
1 compromised version
- Sep 21, 2023
Malware in @zettle-bo/account-statement
1 compromised version
- Sep 21, 2023
Malicious code in @zettle-bo/staff-account (npm)
1 compromised version
- Sep 21, 2023
Malware in @zettle-bo/staff-account
1 compromised version
- Sep 21, 2023
Malicious code in @zettle-bo/settings (npm)
1 compromised version
- Sep 21, 2023
Malware in @zettle-bo/settings
1 compromised version
- Sep 21, 2023
Malicious code in @zettle-bo/account-settings (npm)
1 compromised version
- Sep 21, 2023
Malware in @zettle-bo/account-settings
1 compromised version
- Sep 21, 2023
Malicious code in sentrybrowser5 (npm)
- Sep 21, 2023
Malware in sentrybrowser5
1 compromised version
- Sep 20, 2023
Malicious code in test-package-ings (npm)
1 compromised version
- Sep 20, 2023
Malware in pingserver-test.01
1 compromised version
- Sep 20, 2023
Malicious code in scoot-layout-components (npm)
1 compromised version
- Sep 20, 2023
Malicious code in agopoweryea123 (npm)
2 compromised versions
- Sep 20, 2023
Malware in agopoweryea123
1 compromised version
- Sep 20, 2023
Malware in scoot-layout-components
1 compromised version
- Sep 20, 2023
Malware in symphony-monorepo
1 compromised version
- Sep 20, 2023
Malware in rambox
1 compromised version
- Sep 20, 2023
Malware in puppeteer-example
1 compromised version
- Sep 20, 2023
Malicious code in dot-environment (npm)
- Sep 20, 2023
Malware in dot-environment
1 compromised version
- Sep 19, 2023
Malicious code in bbc-iplayer-sounds-chatbot (npm)
3 compromised versions
- Sep 19, 2023
Malicious code in sw-kendo-atomic-theme (npm)
1 compromised version
- Sep 19, 2023
Malicious code in symphony-monorepo (npm)
1 compromised version
- Sep 19, 2023
Malicious code in rambox (npm)
1 compromised version
- Sep 19, 2023
Malicious code in team-atf-3 (npm)
- Sep 19, 2023
Malicious code in team-atf (npm)
- Sep 19, 2023
Malicious code in fca-chan (npm)
- Sep 19, 2023
Malicious code in apka-papa-chand (npm)
- Sep 19, 2023
Malware in team-atf-3
1 compromised version
- Sep 19, 2023
Malware in team-atf
1 compromised version
- Sep 19, 2023
Malware in fca-chan
1 compromised version
- Sep 19, 2023
Malware in apka-papa-chand
1 compromised version
- Sep 19, 2023
Malicious code in goingwithflow (npm)
4 compromised versions
- Sep 19, 2023
Malicious code in @fixedwidthtable/fixedwidthtable (npm)
3 compromised versions
- Sep 19, 2023
Malware in @fixedwidthtable/fixedwidthtable
1 compromised version
- Sep 19, 2023
Malicious code in @spgy/eslint-plugin-spgy-fe (npm)
- Sep 19, 2023
Malware in @spgy/eslint-plugin-spgy-fe
1 compromised version
- Sep 19, 2023
Malicious code in @virtualsearchtable/virtualsearchtable (npm)
- Sep 19, 2023
Malware in @virtualsearchtable/virtualsearchtable
1 compromised version
- Sep 19, 2023
Malicious code in simple-team-api (npm)
- Sep 19, 2023
Malicious code in fca-dongdz2006 (npm)
- Sep 19, 2023
Malware in simple-team-api
1 compromised version
Page 6286 of 6,645