Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,218 total in npm · sorted newest first- Aug 14, 2023
Malicious code in square-apple-package (npm)
- Aug 14, 2023
Malware in square-apple-package
1 compromised version
- Aug 14, 2023
Malicious code in dependency-exploit-corraldev (npm)
- Aug 14, 2023
Malware in dependency-exploit-corraldev
1 compromised version
- Aug 14, 2023
Malicious code in ynf-dx-webpack-plugins (npm)
- Aug 14, 2023
Malicious code in ynf-dx-scripts (npm)
- Aug 14, 2023
Malicious code in ynf-core-renderer (npm)
- Aug 14, 2023
Malicious code in ynf-core-loader (npm)
- Aug 14, 2023
Malicious code in srm-front-util (npm)
- Aug 14, 2023
Malicious code in progress-player (npm)
- Aug 14, 2023
Malicious code in pingan-vue-floating (npm)
1 compromised version
- Aug 14, 2023
Malicious code in cloud-room-video (npm)
- Aug 14, 2023
Malware in cloud-room-video
1 compromised version
- Aug 14, 2023
Malware in srm-front-util
1 compromised version
- Aug 14, 2023
Malware in ynf-core-renderer
1 compromised version
- Aug 14, 2023
Malware in ynf-dx-scripts
1 compromised version
- Aug 14, 2023
Malware in ynf-core-loader
1 compromised version
- Aug 14, 2023
Malware in progress-player
1 compromised version
- Aug 14, 2023
Malware in pingan-vue-floating
1 compromised version
- Aug 14, 2023
Malware in ynf-dx-webpack-plugins
1 compromised version
- Aug 14, 2023
Malware in hsqwe
1 compromised version
- Aug 13, 2023
Malicious code in express-opentelemetry (npm)
1 compromised version
- Aug 13, 2023
Malicious code in blockly-mirror-demo (npm)
1 compromised version
- Aug 13, 2023
Malicious code in zustand-rc.1 (npm)
1 compromised version
- Aug 11, 2023
Malicious code in hsqwe (npm)
1 compromised version
- Aug 11, 2023
Malicious code in horaw (npm)
- Aug 11, 2023
Malware in horaw
1 compromised version
- Aug 11, 2023
Malicious code in @ratecenter/shared (npm)
- Aug 11, 2023
Malware in @ratecenter/shared
1 compromised version
- Aug 11, 2023
Malicious code in fiji-core-pal (npm)
2 compromised versions
- Aug 11, 2023
Malware in fiji-core-pal
1 compromised version
- Aug 10, 2023
Malicious code in eslint-plugin-ironfish (npm)
3 compromised versions
- Aug 10, 2023
Malicious code in react-dropzone-legacy (npm)
1 compromised version
- Aug 10, 2023
Malicious code in exp-core-style (npm)
1 compromised version
- Aug 10, 2023
Malware in exp-core-style
1 compromised version
- Aug 10, 2023
Malware in react-dropzone-legacy
1 compromised version
- Aug 10, 2023
Malicious code in fca-jordan-amiir (npm)
- Aug 10, 2023
Malware in fca-jordan-amiir
1 compromised version
- Aug 10, 2023
Malicious code in tra-arifvauchat-api (npm)
- Aug 10, 2023
Malicious code in tra-arifchat-api (npm)
- Aug 10, 2023
Malware in tra-arifvauchat-api
1 compromised version
- Aug 10, 2023
Malware in tra-arifchat-api
1 compromised version
- Aug 10, 2023
Malicious code in react-native-transparent-video (npm)
2 compromised versions
- Aug 10, 2023
Malware in react-native-transparent-video
1 compromised version
- Aug 10, 2023
Malware in noblox.js-ssh
1 compromised version
- Aug 9, 2023
Malicious code in nequi-aws-dynamodb (npm)
2 compromised versions
- Aug 9, 2023
Malicious code in nequi-ci-utils (npm)
1 compromised version
- Aug 9, 2023
Malicious code in eslint-config-onyx-ui (npm)
3 compromised versions
- Aug 9, 2023
Malicious code in jest-cucumber-reporter (npm)
1 compromised version
- Aug 9, 2023
Malicious code in eslint-config-ironfish (npm)
4 compromised versions
Page 6298 of 6,645