Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,875 total in npm · sorted newest first- Jun 19, 2023
Malware in gitlabhook
1 compromised version
- Jun 19, 2023
Malware in html.sortable
1 compromised version
- Jun 19, 2023
Malware in audit-ejs
1 compromised version
- Jun 19, 2023
Malware in audit-vue
1 compromised version
- Jun 19, 2023
Malware in chart-vxe
1 compromised version
- Jun 19, 2023
Malware in vue-gws
1 compromised version
- Jun 19, 2023
Malware in dvknpm-dev
1 compromised version
- Jun 19, 2023
Malicious code in dvknpm (npm)
- Jun 19, 2023
Malware in dvknpm
1 compromised version
- Jun 19, 2023
Malicious code in vue-audit (npm)
- Jun 19, 2023
Malicious code in price-record (npm)
- Jun 19, 2023
Malicious code in price-fetch (npm)
- Jun 19, 2023
Malicious code in ejs-audit (npm)
- Jun 18, 2023
Malicious code in qrscrappers (npm)
1 compromised version
- Jun 17, 2023
Malicious code in gitlabhook (npm)
3 compromised versions
- Jun 16, 2023
Malicious code in chain00x_tsrc (npm)
1 compromised version
- Jun 16, 2023
Malicious code in chain00x_rce1 (npm)
5 compromised versions
- Jun 16, 2023
Malicious code in chain00xtest3 (npm)
1 compromised version
- Jun 16, 2023
Malicious code in chain00xtest2 (npm)
1 compromised version
- Jun 16, 2023
Malicious code in html.sortable (npm)
3 compromised versions
- Jun 16, 2023
Malicious code in dvknpm-dev (npm)
1 compromised version
- Jun 15, 2023
Malicious code in eslint-config-mirakl (npm)
1 compromised version
- Jun 15, 2023
Malicious code in vue-gws (npm)
- Jun 15, 2023
Malicious code in chart-vxe (npm)
- Jun 15, 2023
Malicious code in audit-vue (npm)
- Jun 15, 2023
Malicious code in audit-ejs (npm)
- Jun 14, 2023
Malicious code in grabathon-4.0 (npm)
1 compromised version
- Jun 14, 2023
Malicious code in cdp-ops--ts-accesslog (npm)
3 compromised versions
- Jun 14, 2023
Malicious code in snew-classic-ui (npm)
1 compromised version
- Jun 14, 2023
Malicious code in dragonsense-config (npm)
1 compromised version
- Jun 14, 2023
Malicious code in dragonconnect-config (npm)
1 compromised version
- Jun 14, 2023
Malicious code in fabric-integration (npm)
1 compromised version
- Jun 14, 2023
Malware in js-integration-demo
1 compromised version
- Jun 14, 2023
Malicious code in js-integration-demo (npm)
1 compromised version
- Jun 14, 2023
Malicious code in tslib-react (npm)
- Jun 13, 2023
Malicious code in tamagoshi (npm)
- Jun 13, 2023
Malware in tamagoshi
1 compromised version
- Jun 13, 2023
Malicious code in testfoo-my (npm)
- Jun 13, 2023
Malicious code in packj (npm)
- Jun 13, 2023
Malware in testfoo-my
1 compromised version
- Jun 13, 2023
Malware in packj
1 compromised version
- Jun 13, 2023
Malicious code in wagmi-demo (npm)
- Jun 13, 2023
Malicious code in sample-app-typescript (npm)
- Jun 13, 2023
Malicious code in react-router-packages (npm)
- Jun 13, 2023
Malicious code in rainbow-bridge-frontend (npm)
- Jun 13, 2023
Malicious code in migrate-branch (npm)
- Jun 13, 2023
Malware in react-router-packages
1 compromised version
- Jun 13, 2023
Malware in rainbow-bridge-frontend
1 compromised version
- Jun 13, 2023
Malware in migrate-branch
1 compromised version
- Jun 13, 2023
Malware in wagmi-demo
1 compromised version
Page 6304 of 6,638