Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,218 total in npm · sorted newest first- Aug 7, 2023
Malware in discordd.jss
1 compromised version
- Aug 7, 2023
Malware in discordd
1 compromised version
- Aug 7, 2023
Malware in discorddd
1 compromised version
- Aug 7, 2023
Malware in my-fallen-web
1 compromised version
- Aug 7, 2023
Malicious code in oy-cms-analytics (npm)
4 compromised versions
- Aug 7, 2023
Malicious code in mecfront (npm)
3 compromised versions
- Aug 7, 2023
Malware in mecfront
1 compromised version
- Aug 7, 2023
Malware in oy-cms-analytics
1 compromised version
- Aug 7, 2023
Malicious code in @oyshoweb/front (npm)
- Aug 7, 2023
Malware in @oyshoweb/front
1 compromised version
- Aug 6, 2023
Malicious code in email-helper (npm)
1 compromised version
- Aug 6, 2023
Malicious code in codeql (npm)
1 compromised version
- Aug 5, 2023
Malicious code in infocaster-frontend-bootstrap-4-starter (npm)
1 compromised version
- Aug 5, 2023
Malicious code in @n9xcnr5test/n9xcnr5 (npm)
2 compromised versions
- Aug 5, 2023
Malicious code in n9xcnr5 (npm)
1 compromised version
- Aug 4, 2023
Malicious code in discordd (npm)
1 compromised version
- Aug 4, 2023
Malicious code in my-fallen-web (npm)
1 compromised version
- Aug 4, 2023
Malicious code in binarium-crm (npm)
- Aug 3, 2023
Malicious code in papaya_pear_vicious (npm)
1 compromised version
- Aug 3, 2023
Malicious code in ent-screenshare-wrapper (npm)
1 compromised version
- Aug 3, 2023
Malware in json2stringfy
1 compromised version
- Aug 3, 2023
Malware in json2double
1 compromised version
- Aug 2, 2023
Malicious code in twodc-visualizer (npm)
1 compromised version
- Aug 2, 2023
Malicious code in auto-assign-team-action (npm)
1 compromised version
- Aug 2, 2023
Malicious code in @kennylindahl/malicious-npm-package (npm)
- Aug 2, 2023
Malware in @kennylindahl/malicious-npm-package
1 compromised version
- Aug 2, 2023
Malicious code in noblox.js-vps (npm)
- Aug 2, 2023
Malware in noblox.js-vps
1 compromised version
- Aug 1, 2023
Malware in command-launcher
1 compromised version
- Aug 1, 2023
Malicious code in vue-router-vue3 (npm)
- Aug 1, 2023
Malicious code in sentrybrowser7 (npm)
- Aug 1, 2023
Malicious code in hsisu (npm)
- Aug 1, 2023
Malicious code in bluehost-wordpress-plugin (npm)
- Aug 1, 2023
Malware in hsisu
1 compromised version
- Aug 1, 2023
Malware in sentrybrowser7
1 compromised version
- Aug 1, 2023
Malware in vue-router-vue3
1 compromised version
- Aug 1, 2023
Malware in bluehost-wordpress-plugin
1 compromised version
- Aug 1, 2023
Malicious code in testhacknowz (npm)
- Aug 1, 2023
Malicious code in hackzvijay (npm)
- Aug 1, 2023
Malicious code in flot-axis (npm)
- Aug 1, 2023
Malware in testhacknowz
1 compromised version
- Aug 1, 2023
Malware in hackzvijay
1 compromised version
- Aug 1, 2023
Malware in flot-axis
1 compromised version
- Aug 1, 2023
Malware in coinbase-wallet-sdk
1 compromised version
- Aug 1, 2023
Malicious code in fca-hrz-reup (npm)
- Aug 1, 2023
Malware in fca-hrz-reup
1 compromised version
- Aug 1, 2023
Malicious code in @ozon-maps/map-sdk (npm)
- Aug 1, 2023
Malware in @ozon-maps/map-sdk
1 compromised version
- Aug 1, 2023
Malicious code in storyblok-bridge (npm)
- Aug 1, 2023
Malicious code in eslint-plugin-scp-custom-rules (npm)
Page 6300 of 6,645