Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,218 total in npm · sorted newest first- Jun 3, 2023
Malicious code in javascript-appfabric-logger (npm)
3 compromised versions
- Jun 2, 2023
Malware in next2ejs
1 compromised version
- Jun 2, 2023
Malware in vue2ejs
1 compromised version
- Jun 1, 2023
Malicious code in gd-company-updates (npm)
3 compromised versions
- Jun 1, 2023
Malicious code in reat-com (npm)
- Jun 1, 2023
Malicious code in libponenunber-js (npm)
- Jun 1, 2023
Malicious code in easy-lightbox (npm)
- Jun 1, 2023
Malware in libponenunber-js
1 compromised version
- Jun 1, 2023
Malware in native-svg
1 compromised version
- Jun 1, 2023
Malware in easy-lightbox
1 compromised version
- Jun 1, 2023
Malware in reat-com
1 compromised version
- Jun 1, 2023
Malware in calandraca
1 compromised version
- Jun 1, 2023
Malware in chartjs-2
1 compromised version
- Jun 1, 2023
Malicious code in @leanmull/leveldb-decryptor (npm)
23 compromised versions
- Jun 1, 2023
Malicious code in @leanmull/ldb-decryptor (npm)
- Jun 1, 2023
Malware in @leanmull/ldb-decryptor
1 compromised version
- Jun 1, 2023
Malware in @leanmull/leveldb-decryptor
1 compromised version
- May 31, 2023
Malicious code in chartjs-2 (npm)
1 compromised version
- May 31, 2023
Malicious code in native-svg (npm)
1 compromised version
- May 31, 2023
Malicious code in calandraca (npm)
1 compromised version
- May 31, 2023
Malicious code in rfs-utils (npm)
1 compromised version
- May 30, 2023
Malicious code in coveo-101-commerce (npm)
1 compromised version
- May 30, 2023
Malicious code in @mddsfmsdflm/itemselector (npm)
2 compromised versions
- May 29, 2023
Malicious code in coveo.analytics-fts (npm)
1 compromised version
- May 29, 2023
Malicious code in useravatarcircleicon (npm)
1 compromised version
- May 29, 2023
Malicious code in @yuga-labs/web3-react (npm)
1 compromised version
- May 29, 2023
Malware in mintel-react-ui
1 compromised version
- May 29, 2023
Malware in mintel-tokens
1 compromised version
- May 29, 2023
Malware in mintel-navigation
1 compromised version
- May 29, 2023
Malicious code in superagtn (npm)
- May 29, 2023
Malware in pitito
1 compromised version
- May 29, 2023
Malware in elpititaso
1 compromised version
- May 29, 2023
Malware in superagt
1 compromised version
- May 29, 2023
Malware in superagtn
1 compromised version
- May 29, 2023
Malicious code in test-solhint (npm)
1 compromised version
- May 29, 2023
Malware in test-solhint
1 compromised version
- May 29, 2023
Malware in test-op-solhint
1 compromised version
- May 29, 2023
Malicious code in testingsomethingonnpm (npm)
- May 29, 2023
Malicious code in lupintestingsomethingnewonnpmagain (npm)
1 compromised version
- May 29, 2023
Malware in testingsomethingonnpm
1 compromised version
- May 29, 2023
Malware in lupintestingsomethingnewonnpmagain
1 compromised version
- May 29, 2023
Malicious code in @brand_apps/easystart (npm)
3 compromised versions
- May 29, 2023
Malware in @brand_apps/easystart
1 compromised version
- May 29, 2023
Malicious code in pruebalol1 (npm)
- May 29, 2023
Malicious code in pruebalol (npm)
- May 29, 2023
Malicious code in npm-webcomponent-murphysms1 (npm)
- May 29, 2023
Malicious code in firtssocketia2 (npm)
- May 29, 2023
Malware in pruebalol1
1 compromised version
- May 29, 2023
Malware in firtssocketia2
1 compromised version
- May 29, 2023
Malware in npm-webcomponent-murphysms1
1 compromised version
Page 6315 of 6,645