Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,761 total in npm · sorted newest first- Jun 1, 2023
Malware in libponenunber-js
1 compromised version
- Jun 1, 2023
Malware in native-svg
1 compromised version
- Jun 1, 2023
Malware in easy-lightbox
1 compromised version
- Jun 1, 2023
Malware in reat-com
1 compromised version
- Jun 1, 2023
Malware in calandraca
1 compromised version
- Jun 1, 2023
Malware in chartjs-2
1 compromised version
- Jun 1, 2023
Malicious code in @leanmull/leveldb-decryptor (npm)
23 compromised versions
- Jun 1, 2023
Malicious code in @leanmull/ldb-decryptor (npm)
- Jun 1, 2023
Malware in @leanmull/ldb-decryptor
1 compromised version
- Jun 1, 2023
Malware in @leanmull/leveldb-decryptor
1 compromised version
- May 31, 2023
Malicious code in chartjs-2 (npm)
1 compromised version
- May 31, 2023
Malicious code in native-svg (npm)
1 compromised version
- May 31, 2023
Malicious code in calandraca (npm)
1 compromised version
- May 31, 2023
Malicious code in rfs-utils (npm)
1 compromised version
- May 30, 2023
Malicious code in coveo-101-commerce (npm)
1 compromised version
- May 30, 2023
Malicious code in @mddsfmsdflm/itemselector (npm)
2 compromised versions
- May 29, 2023
Malicious code in coveo.analytics-fts (npm)
1 compromised version
- May 29, 2023
Malicious code in useravatarcircleicon (npm)
1 compromised version
- May 29, 2023
Malicious code in @yuga-labs/web3-react (npm)
1 compromised version
- May 29, 2023
Malware in mintel-react-ui
1 compromised version
- May 29, 2023
Malware in mintel-tokens
1 compromised version
- May 29, 2023
Malware in mintel-navigation
1 compromised version
- May 29, 2023
Malicious code in superagtn (npm)
- May 29, 2023
Malware in pitito
1 compromised version
- May 29, 2023
Malware in elpititaso
1 compromised version
- May 29, 2023
Malware in superagt
1 compromised version
- May 29, 2023
Malware in superagtn
1 compromised version
- May 29, 2023
Malicious code in test-solhint (npm)
1 compromised version
- May 29, 2023
Malware in test-solhint
1 compromised version
- May 29, 2023
Malware in test-op-solhint
1 compromised version
- May 29, 2023
Malicious code in testingsomethingonnpm (npm)
- May 29, 2023
Malicious code in lupintestingsomethingnewonnpmagain (npm)
1 compromised version
- May 29, 2023
Malware in testingsomethingonnpm
1 compromised version
- May 29, 2023
Malware in lupintestingsomethingnewonnpmagain
1 compromised version
- May 29, 2023
Malicious code in @brand_apps/easystart (npm)
3 compromised versions
- May 29, 2023
Malware in @brand_apps/easystart
1 compromised version
- May 29, 2023
Malicious code in pruebalol1 (npm)
- May 29, 2023
Malicious code in pruebalol (npm)
- May 29, 2023
Malicious code in npm-webcomponent-murphysms1 (npm)
- May 29, 2023
Malicious code in firtssocketia2 (npm)
- May 29, 2023
Malware in pruebalol1
1 compromised version
- May 29, 2023
Malware in firtssocketia2
1 compromised version
- May 29, 2023
Malware in npm-webcomponent-murphysms1
1 compromised version
- May 29, 2023
Malware in pruebalol
1 compromised version
- May 29, 2023
Malicious code in cptalertbox (npm)
3 compromised versions
- May 28, 2023
Malicious code in highchartexport (npm)
1 compromised version
- May 28, 2023
Malicious code in itemsselector (npm)
1 compromised version
- May 28, 2023
Malicious code in highchartsofflineexport (npm)
1 compromised version
- May 28, 2023
Malicious code in @satsuitesdk/score-choice-policy (npm)
1 compromised version
- May 27, 2023
Malicious code in superagt (npm)
2 compromised versions
Page 6306 of 6,636