Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,738 total in npm · sorted newest first- May 24, 2023
Malicious code in payouts-sdk-samples (npm)
1 compromised version
- May 24, 2023
Malicious code in int_access_worldpay_sfra (npm)
1 compromised version
- May 23, 2023
Malicious code in wcc-connector (npm)
1 compromised version
- May 23, 2023
Malicious code in obao-digital-pnm-ui (npm)
1 compromised version
- May 22, 2023
Malicious code in standforusz (npm)
- May 22, 2023
Malware in standforusz
1 compromised version
- May 22, 2023
Malicious code in react-vuejs (npm)
- May 22, 2023
Malware in react-vuejs
1 compromised version
- May 21, 2023
Malicious code in uurl-search-params (npm)
1 compromised version
- May 20, 2023
Malicious code in stripe-terminal-react-native (npm)
1 compromised version
- May 20, 2023
Malicious code in mets-disclosures (npm)
1 compromised version
- May 19, 2023
Malicious code in microsoft.quantum.sdk (npm)
1 compromised version
- May 18, 2023
Malicious code in docs-component-follow-public-pop (npm)
1 compromised version
- May 18, 2023
Malicious code in docs-component-title (npm)
2 compromised versions
- May 18, 2023
Malicious code in docs-component-advanced-permission (npm)
1 compromised version
- May 18, 2023
Malicious code in docs-component-like (npm)
1 compromised version
- May 18, 2023
Malicious code in docs-component-folder-selector (npm)
2 compromised versions
- May 18, 2023
Malicious code in index-template-mets (npm)
1 compromised version
- May 17, 2023
Malicious code in nightmaretestingpackage (npm)
1 compromised version
- May 17, 2023
Malicious code in vue2ejs (npm)
- May 17, 2023
Malicious code in next2ejs (npm)
- May 16, 2023
Malicious code in shitpa (npm)
- May 16, 2023
Malware in shitpa
1 compromised version
- May 16, 2023
Malicious code in ipstringfy (npm)
- May 16, 2023
Malicious code in ipsecurity (npm)
- May 15, 2023
Malicious code in lexicalclipboard (npm)
1 compromised version
- May 15, 2023
Malicious code in lexicaltext (npm)
1 compromised version
- May 15, 2023
Malicious code in lexicalutils (npm)
1 compromised version
- May 15, 2023
Malware in cfa-styleguide
1 compromised version
- May 15, 2023
Malware in flying_pusher
1 compromised version
- May 15, 2023
Malware in maddy_test
1 compromised version
- May 15, 2023
Malware in fotkakukur
1 compromised version
- May 15, 2023
Malicious code in http-resources (npm)
- May 15, 2023
Malicious code in buffer-ex (npm)
- May 15, 2023
Malware in http-resources
1 compromised version
- May 15, 2023
Malware in buffer-ex
1 compromised version
- May 15, 2023
Malware in xml2binary
1 compromised version
- May 15, 2023
Malware in xml2yaml
1 compromised version
- May 15, 2023
Malicious code in yaml2binary (npm)
- May 15, 2023
Malicious code in iputiljs (npm)
- May 15, 2023
Malicious code in ipmacjs (npm)
- May 14, 2023
Malicious code in itfd (npm)
4 compromised versions
- May 14, 2023
Malicious code in fusion-ng-theme (npm)
1 compromised version
- May 14, 2023
Malicious code in fotkakukur (npm)
- May 13, 2023
Malicious code in maddy_test (npm)
1 compromised version
- May 13, 2023
Malicious code in flying_pusher (npm)
- May 13, 2023
Malicious code in cfa-styleguide (npm)
6 compromised versions
- May 12, 2023
Malicious code in ikea-jssdk (npm)
1 compromised version
- May 12, 2023
Malicious code in indoorviewer (npm)
1 compromised version
- May 12, 2023
Malicious code in verycoolzpac2 (npm)
10 compromised versions
Page 6307 of 6,635