Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,218 total in npm · sorted newest first- Aug 24, 2023
Malicious code in dexalot-docs (npm)
1 compromised version
- Aug 24, 2023
Malicious code in hardhat-contract (npm)
2 compromised versions
- Aug 24, 2023
Malicious code in file-format-series-json-to-sketch (npm)
1 compromised version
- Aug 24, 2023
Malicious code in sketch-71-symbol-resync (npm)
1 compromised version
- Aug 24, 2023
Malicious code in sketch-ipsum (npm)
1 compromised version
- Aug 24, 2023
Malicious code in fca-zeid (npm)
22 compromised versions
- Aug 24, 2023
Malware in fca-zeid
1 compromised version
- Aug 24, 2023
Malicious code in cncf-interactive-landscape (npm)
5 compromised versions
- Aug 24, 2023
Malicious code in funcraft-api-v3 (npm)
4 compromised versions
- Aug 24, 2023
Malware in funcraft-api-v3
1 compromised version
- Aug 24, 2023
Malicious code in fca-orion (npm)
2 compromised versions
- Aug 24, 2023
Malware in fca-orion
1 compromised version
- Aug 24, 2023
Malicious code in fca-spbot (npm)
- Aug 24, 2023
Malware in fca-spbot
1 compromised version
- Aug 24, 2023
Malicious code in fca-supportbot (npm)
- Aug 24, 2023
Malware in fca-supportbot
1 compromised version
- Aug 24, 2023
Malicious code in fca-traarifvau-api (npm)
1 compromised version
- Aug 24, 2023
Malware in fca-traarifvau-api
1 compromised version
- Aug 24, 2023
Malicious code in casino.web (npm)
- Aug 24, 2023
Malicious code in bspin.mobilecasino (npm)
- Aug 23, 2023
Malicious code in marionette-ui-components (npm)
1 compromised version
- Aug 23, 2023
Malicious code in gradient-function (npm)
1 compromised version
- Aug 23, 2023
Malicious code in sso-map (npm)
2 compromised versions
- Aug 22, 2023
Malicious code in angl-archtslint (npm)
2 compromised versions
- MAL-2023-1538Malwarenpmalksjdaskldjklj12kl3jkl12jkljaskldjaklsjdlkashjflksdjhfgkldsjlkgop123i4poiopalsAug 22, 2023
Malicious code in alksjdaskldjklj12kl3jkl12jkljaskldjaklsjdlkashjflksdjhfgkldsjlkgop123i4poiopals (npm)
1 compromised version
- Aug 22, 2023
Malicious code in le-core-infra (npm)
1 compromised version
- Aug 22, 2023
Malicious code in lp-transporter (npm)
1 compromised version
- Aug 22, 2023
Malicious code in js2restutils (npm)
1 compromised version
- Aug 22, 2023
Malicious code in lp-vue-components (npm)
1 compromised version
- Aug 22, 2023
Malicious code in react-vis-master (npm)
1 compromised version
- Aug 22, 2023
Malicious code in testtttecsc (npm)
1 compromised version
- Aug 22, 2023
Malicious code in stripe-identity-react-native-example (npm)
1 compromised version
- Aug 22, 2023
Malicious code in rb-journey-details (npm)
1 compromised version
- Aug 22, 2023
Malicious code in @rsi-core-services/rsi-authorization-client (npm)
- Aug 22, 2023
Malware in @rsi-core-services/rsi-authorization-client
1 compromised version
- Aug 22, 2023
Malicious code in mapsapi-area (npm)
1 compromised version
- Aug 21, 2023
Malicious code in @lg-private/mongo-nav (npm)
- Aug 21, 2023
Malware in @lg-private/mongo-nav
1 compromised version
- Aug 21, 2023
Malicious code in business_api_client (npm)
- Aug 21, 2023
Malware in business_api_client
1 compromised version
- Aug 21, 2023
Malicious code in as-ui-kit (npm)
- Aug 21, 2023
Malware in as-ui-kit
1 compromised version
- Aug 21, 2023
Malicious code in fca-nayan-remake (npm)
- Aug 21, 2023
Malware in fca-nayan-remake
1 compromised version
- Aug 21, 2023
Malicious code in normandy (npm)
- Aug 21, 2023
Malware in normandy
1 compromised version
- Aug 21, 2023
Malicious code in hreport-preview (npm)
- Aug 21, 2023
Malware in hreport-preview
1 compromised version
- Aug 21, 2023
Malicious code in corporate-logger (npm)
- Aug 21, 2023
Malware in corporate-logger
1 compromised version
Page 6295 of 6,645