Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,506 total in npm · sorted newest first- May 1, 2023
Malicious code in webpack-dev-server.legacy (npm)
1 compromised version
- May 1, 2023
Malicious code in react-test-renderer-17 (npm)
1 compromised version
- May 1, 2023
Malicious code in myattenuator (npm)
1 compromised version
- May 1, 2023
Malicious code in stateful-fastclick (npm)
1 compromised version
- May 1, 2023
Malicious code in tempomati-omega-69-emcuf7 (npm)
1 compromised version
- May 1, 2023
Malicious code in tempomati-omega-5-emcuf5 (npm)
1 compromised version
- May 1, 2023
Malicious code in tempomati-omega-5-emcuf311 (npm)
1 compromised version
- May 1, 2023
Malicious code in brightening (npm)
- May 1, 2023
Malware in brightening
1 compromised version
- May 1, 2023
Malicious code in ozstesting-pt (npm)
- May 1, 2023
Malware in ozstesting-pt
1 compromised version
- May 1, 2023
Malicious code in danikpack (npm)
- May 1, 2023
Malware in danikpack
1 compromised version
- May 1, 2023
Malicious code in sendtelegram (npm)
- May 1, 2023
Malicious code in apitelegram (npm)
- May 1, 2023
Malware in apitelegram
1 compromised version
- May 1, 2023
Malware in sendtelegram
1 compromised version
- May 1, 2023
Malicious code in zsbpwebsdktest3 (npm)
3 compromised versions
- May 1, 2023
Malicious code in compositionupdate (npm)
1 compromised version
- May 1, 2023
Malicious code in jumflot (npm)
1 compromised version
- May 1, 2023
Malicious code in sovrin-networks (npm)
1 compromised version
- May 1, 2023
Malicious code in editor-layer-index (npm)
3 compromised versions
- May 1, 2023
Malicious code in texture-allocator (npm)
2 compromised versions
- May 1, 2023
Malicious code in eslint-plugin-indeed (npm)
2 compromised versions
- May 1, 2023
Malicious code in ing-orange-lu-luxtrust-oaw-mobile-authentication (npm)
- May 1, 2023
Malware in ing-orange-lu-luxtrust-oaw-mobile-authentication
1 compromised version
- May 1, 2023
Malicious code in skyscanner-themes (npm)
1 compromised version
- Apr 30, 2023
Malicious code in zsbpwebsdktest (npm)
5 compromised versions
- Apr 30, 2023
Malicious code in smart-commons (npm)
8 compromised versions
- Apr 30, 2023
Malicious code in ladoputi-static (npm)
1 compromised version
- Apr 29, 2023
Malicious code in apache2 (npm)
1 compromised version
- Apr 29, 2023
Malicious code in egstore-carousel (npm)
3 compromised versions
- Apr 29, 2023
Malicious code in dist-web (npm)
2 compromised versions
- Apr 29, 2023
Malicious code in plain-function (npm)
2 compromised versions
- Apr 29, 2023
Malicious code in twinmotion (npm)
2 compromised versions
- Apr 29, 2023
Malicious code in commentrating (npm)
2 compromised versions
- Apr 29, 2023
Malicious code in diesel-site (npm)
2 compromised versions
- Apr 29, 2023
Malicious code in flp_hk (npm)
1 compromised version
- Apr 29, 2023
Malicious code in rb-notification-banner (npm)
1 compromised version
- Apr 29, 2023
Malicious code in scuid-x (npm)
3 compromised versions
- Apr 29, 2023
Malicious code in testforconfusion (npm)
3 compromised versions
- Apr 29, 2023
Malicious code in scuntest (npm)
1 compromised version
- Apr 29, 2023
Malicious code in falsepositivecheck6969 (npm)
1 compromised version
- Apr 29, 2023
Malicious code in zsbpwebsdk (npm)
5 compromised versions
- Apr 29, 2023
Malicious code in donuts.node-build (npm)
6 compromised versions
- Apr 29, 2023
Malicious code in thisisjustfortesting (npm)
1 compromised version
- Apr 28, 2023
Malicious code in @infinitebrahmanuniverse/nolb-cys (npm)
1 compromised version
- Apr 28, 2023
Malicious code in documentation-ably-realtime (npm)
1 compromised version
- Apr 28, 2023
Malicious code in links-3 (npm)
2 compromised versions
- Apr 28, 2023
Malicious code in @hyperion-util/deferred-value (npm)
1 compromised version
Page 6311 of 6,631