Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,218 total in npm · sorted newest first- Aug 21, 2023
Malicious code in crcloud-layout (npm)
- Aug 21, 2023
Malware in crcloud-layout
1 compromised version
- Aug 21, 2023
Malicious code in essc-crypto (npm)
- Aug 21, 2023
Malware in essc-crypto
1 compromised version
- Aug 21, 2023
Malicious code in urs-remote (npm)
- Aug 21, 2023
Malware in urs-remote
1 compromised version
- Aug 21, 2023
Malicious code in as-ui-deals (npm)
- Aug 21, 2023
Malware in as-ui-deals
1 compromised version
- Aug 21, 2023
Malicious code in test-dr-pkg-001 (npm)
- Aug 21, 2023
Malware in test-dr-pkg-001
1 compromised version
- Aug 21, 2023
Malicious code in auth0-playground (npm)
1 compromised version
- Aug 21, 2023
Malicious code in usaa-checkbox (npm)
- Aug 21, 2023
Malware in usaa-checkbox
1 compromised version
- Aug 21, 2023
Malicious code in usaa-progress-indicator (npm)
- Aug 21, 2023
Malware in usaa-progress-indicator
1 compromised version
- Aug 21, 2023
Malicious code in usaa-page-transition (npm)
- Aug 21, 2023
Malware in usaa-page-transition
1 compromised version
- Aug 21, 2023
Malicious code in ent-cas-common-utils (npm)
- Aug 21, 2023
Malware in ent-cas-common-utils
1 compromised version
- Aug 21, 2023
Malicious code in fixed-sidebar-modal (npm)
- Aug 21, 2023
Malware in fixed-sidebar-modal
1 compromised version
- Aug 21, 2023
Malicious code in test-result-logger (npm)
- Aug 21, 2023
Malware in test-result-logger
1 compromised version
- Aug 21, 2023
Malicious code in usaa-qtest-reporter (npm)
- Aug 21, 2023
Malware in usaa-qtest-reporter
1 compromised version
- Aug 21, 2023
Malicious code in usaa-mock-server (npm)
- Aug 21, 2023
Malware in usaa-mock-server
1 compromised version
- Aug 21, 2023
Malicious code in ent-disclosure (npm)
- Aug 21, 2023
Malware in ent-disclosure
1 compromised version
- Aug 21, 2023
Malicious code in personal-profile-utils (npm)
- Aug 21, 2023
Malware in personal-profile-utils
1 compromised version
- Aug 21, 2023
Malicious code in usaa-sass-loader (npm)
- Aug 21, 2023
Malware in usaa-sass-loader
1 compromised version
- Aug 21, 2023
Malicious code in browserslist-config-usaa (npm)
- Aug 21, 2023
Malware in browserslist-config-usaa
1 compromised version
- Aug 21, 2023
Malicious code in vision-chart (npm)
11 compromised versions
- Aug 21, 2023
Malicious code in docs-public-api (npm)
2 compromised versions
- Aug 20, 2023
Malicious code in matomo-screenshot-testing (npm)
1 compromised version
- Aug 20, 2023
Malicious code in securitytxt-worker (npm)
2 compromised versions
- Aug 20, 2023
Malicious code in owncloud-js-dev (npm)
1 compromised version
- Aug 20, 2023
Malicious code in web-dev-for-beginners (npm)
1 compromised version
- Aug 20, 2023
Malicious code in z-foundation (npm)
1 compromised version
- Aug 20, 2023
Malicious code in jscrambler-permission-utils (npm)
1 compromised version
- Aug 20, 2023
Malicious code in wpi-rules-valid-events (npm)
1 compromised version
- Aug 20, 2023
Malicious code in jscrambler-dashboard-components (npm)
1 compromised version
- Aug 20, 2023
Malicious code in code-debug-codes (npm)
1 compromised version
- Aug 20, 2023
Malicious code in jscrambler-cookies (npm)
1 compromised version
- Aug 20, 2023
Malicious code in wpi-xmldom (npm)
1 compromised version
- Aug 20, 2023
Malicious code in sankson (npm)
2 compromised versions
- Aug 20, 2023
Malicious code in hackonex (npm)
2 compromised versions
Page 6296 of 6,645