Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,218 total in npm · sorted newest first- Jun 6, 2023
Malicious code in fp-aanvragen-bankrekening (npm)
- Jun 6, 2023
Malicious code in fi-accounts (npm)
- Jun 6, 2023
Malicious code in fc-accounts-service (npm)
4 compromised versions
- Jun 6, 2023
Malware in fc-accounts-service
1 compromised version
- Jun 6, 2023
Malware in fp-aanvragen-bankrekening
1 compromised version
- Jun 6, 2023
Malware in fc-amount
1 compromised version
- Jun 6, 2023
Malware in theme-next
1 compromised version
- Jun 6, 2023
Malware in legal-footer
1 compromised version
- Jun 6, 2023
Malware in multivariate-experiments
1 compromised version
- Jun 6, 2023
Malware in fi-accounts
1 compromised version
- Jun 6, 2023
Malware in privacy-mask
1 compromised version
- Jun 6, 2023
Malware in kiosk-util
1 compromised version
- Jun 6, 2023
Malicious code in canvas-text-colorizer (npm)
- Jun 6, 2023
Malware in canvas-text-colorizer
1 compromised version
- Jun 6, 2023
Malicious code in gsattrack (npm)
- Jun 6, 2023
Malware in gsattrack
1 compromised version
- Jun 5, 2023
Malicious code in navigation-component-tco (npm)
1 compromised version
- Jun 5, 2023
Malicious code in fc-step (npm)
1 compromised version
- Jun 5, 2023
Malicious code in fc-lsm (npm)
1 compromised version
- Jun 5, 2023
Malicious code in fc-assets (npm)
1 compromised version
- Jun 5, 2023
Malicious code in fc-amount (npm)
1 compromised version
- Jun 5, 2023
Malicious code in fc-analytics (npm)
1 compromised version
- Jun 5, 2023
Malicious code in fc-iban (npm)
1 compromised version
- Jun 5, 2023
Malicious code in fc-persoonlijke-pas (npm)
1 compromised version
- Jun 5, 2023
Malicious code in fc-login (npm)
1 compromised version
- Jun 5, 2023
Malicious code in oci-console-regions (npm)
- Jun 5, 2023
Malware in eg-shared
1 compromised version
- Jun 5, 2023
Malware in oci-console-regions
1 compromised version
- Jun 5, 2023
Malicious code in trint-bbc (npm)
- Jun 5, 2023
Malicious code in planetbuf (npm)
- Jun 5, 2023
Malicious code in planet-view (npm)
- Jun 5, 2023
Malicious code in aonetecha (npm)
- Jun 5, 2023
Malware in planetbuf
1 compromised version
- Jun 5, 2023
Malware in trint-bbc
1 compromised version
- Jun 5, 2023
Malware in planet-view
1 compromised version
- Jun 5, 2023
Malware in aonetecha
1 compromised version
- Jun 5, 2023
Malicious code in gs-ux-uitoolkit-common (npm)
- Jun 5, 2023
Malware in jquery.select2
1 compromised version
- Jun 5, 2023
Malware in gs-ux-uitoolkit-common
1 compromised version
- Jun 5, 2023
Malicious code in prpostcss-loaderetty-quick (npm)
4 compromised versions
- Jun 5, 2023
Malicious code in idgit-conventional-commitsentity-obj-proxy (npm)
4 compromised versions
- Jun 5, 2023
Malware in idgit-conventional-commitsentity-obj-proxy
1 compromised version
- Jun 5, 2023
Malware in prpostcss-loaderetty-quick
1 compromised version
- Jun 4, 2023
Malicious code in eg-shared (npm)
1 compromised version
- Jun 3, 2023
Malicious code in jquery.select2 (npm)
1 compromised version
- Jun 3, 2023
Malicious code in blablablabla (npm)
1 compromised version
- Jun 3, 2023
Malicious code in node-mac-applescript (npm)
1 compromised version
- Jun 3, 2023
Malicious code in mongoose-geojson-schema-2d (npm)
1 compromised version
- Jun 3, 2023
Malicious code in electron-app-extension (npm)
1 compromised version
- Jun 3, 2023
Malicious code in mongoose-geospatial (npm)
1 compromised version
Page 6314 of 6,645