Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,218 total in npm · sorted newest first- Sep 9, 2023
Malicious code in zara-mkt-core (npm)
2 compromised versions
- Sep 8, 2023
Malicious code in @operational-reporting/wire-contracts (npm)
1 compromised version
- Sep 7, 2023
Malicious code in chatbot-community (npm)
- Sep 7, 2023
Malware in chatbot-community
1 compromised version
- Sep 6, 2023
Malware in @grabdefence/trust-feature-bank-ui
1 compromised version
- Sep 6, 2023
Malicious code in @ks-radar/radar-error-collect (npm)
1 compromised version
- Sep 6, 2023
Malware in @ks-radar/radar-error-collect
1 compromised version
- Sep 6, 2023
Malicious code in @ks-radar/radar-resource-collect (npm)
- Sep 6, 2023
Malware in @ks-radar/radar-resource-collect
1 compromised version
- Sep 6, 2023
Malicious code in @ks-radar/radar-event-collect (npm)
- Sep 6, 2023
Malware in @ks-radar/radar-event-collect
1 compromised version
- Sep 5, 2023
Malicious code in ivr-payments (npm)
- Sep 5, 2023
Malware in mc-dxp
1 compromised version
- Sep 5, 2023
Malware in ivr-payments
1 compromised version
- Sep 5, 2023
Malware in jupiter-opensdk
1 compromised version
- Sep 5, 2023
Malware in feature-flag-framework
1 compromised version
- Sep 5, 2023
Malware in fiji-core-cryptopool
1 compromised version
- Sep 5, 2023
Malware in fiji-core-foc
1 compromised version
- Sep 5, 2023
Malware in jupiter-i18n
1 compromised version
- Sep 5, 2023
Malware in jupiter-emoji
1 compromised version
- Sep 5, 2023
Malware in fiji-core-framework
1 compromised version
- Sep 5, 2023
Malware in fiji-core-foundation
1 compromised version
- Sep 5, 2023
Malware in course-structure-debugger
1 compromised version
- Sep 5, 2023
Malicious code in dm_commons_utilities (npm)
- Sep 5, 2023
Malware in dm_commons_utilities
1 compromised version
- Sep 5, 2023
Malicious code in betterbit-frame-pkg (npm)
- Sep 5, 2023
Malware in web3-provider-patchers
1 compromised version
- Sep 5, 2023
Malware in metronome-synth-user-lib
1 compromised version
- Sep 5, 2023
Malware in master-oracle-lib
1 compromised version
- Sep 5, 2023
Malware in wallet-watch-asset
1 compromised version
- Sep 5, 2023
Malware in chain-list
1 compromised version
- Sep 5, 2023
Malware in vesper-synth-user-lib
1 compromised version
- Sep 5, 2023
Malware in metronome-ui
1 compromised version
- Sep 5, 2023
Malware in wallet-switch-chain
1 compromised version
- Sep 5, 2023
Malware in wallet-add-chain
1 compromised version
- Sep 5, 2023
Malware in metronome-synth-info-lib
1 compromised version
- Sep 5, 2023
Malware in betterbit-frame-pkg
1 compromised version
- Sep 5, 2023
Malicious code in @grabdefence/trust-feature-bank-ui (npm)
1 compromised version
- Sep 5, 2023
Malicious code in ccfedrtest-poc (npm)
1 compromised version
- Sep 3, 2023
Malicious code in testingoli (npm)
1 compromised version
- Sep 3, 2023
Malicious code in pingserver-test.01 (npm)
1 compromised version
- Sep 2, 2023
Malicious code in metronome-synth-user-lib (npm)
1 compromised version
- Sep 2, 2023
Malicious code in vesper-synth-user-lib (npm)
1 compromised version
- Sep 2, 2023
Malicious code in metronome-synth-info-lib (npm)
1 compromised version
- Sep 2, 2023
Malicious code in www-ankr-com (npm)
1 compromised version
- Sep 2, 2023
Malicious code in master-oracle-lib (npm)
1 compromised version
- Sep 2, 2023
Malicious code in chain-list (npm)
1 compromised version
- Sep 1, 2023
Malicious code in visual_components (npm)
6 compromised versions
- Sep 1, 2023
Malicious code in jupiter-opensdk (npm)
1 compromised version
- Sep 1, 2023
Malicious code in jupiter-i18n (npm)
1 compromised version
Page 6291 of 6,645