Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,218 total in npm · sorted newest first- May 3, 2023
Malicious code in spring-boot-admin-virgil-custom-ui (npm)
4 compromised versions
- May 3, 2023
Malicious code in virgil-spring-boot-starter (npm)
1 compromised version
- May 3, 2023
Malicious code in capacity-planning-projection (npm)
2 compromised versions
- May 2, 2023
Malicious code in staging-opbox-web-browser (npm)
1 compromised version
- May 2, 2023
Malicious code in react-orange-ui (npm)
3 compromised versions
- May 2, 2023
Malware in react-orange-ui
1 compromised version
- May 2, 2023
Malicious code in fkletbbpoc (npm)
1 compromised version
- May 2, 2023
Malicious code in opbox-seller-shop-service (npm)
1 compromised version
- May 2, 2023
Malicious code in opbox-web (npm)
1 compromised version
- May 2, 2023
Malicious code in proton-pack (npm)
5 compromised versions
- May 2, 2023
Malicious code in proton-account (npm)
3 compromised versions
- May 1, 2023
Malicious code in webpack-cli.legacy (npm)
1 compromised version
- May 1, 2023
Malicious code in webpack-dev-server.legacy (npm)
1 compromised version
- May 1, 2023
Malicious code in react-test-renderer-17 (npm)
1 compromised version
- May 1, 2023
Malicious code in myattenuator (npm)
1 compromised version
- May 1, 2023
Malicious code in stateful-fastclick (npm)
1 compromised version
- May 1, 2023
Malicious code in tempomati-omega-69-emcuf7 (npm)
1 compromised version
- May 1, 2023
Malicious code in tempomati-omega-5-emcuf5 (npm)
1 compromised version
- May 1, 2023
Malicious code in tempomati-omega-5-emcuf311 (npm)
1 compromised version
- May 1, 2023
Malicious code in brightening (npm)
- May 1, 2023
Malware in brightening
1 compromised version
- May 1, 2023
Malicious code in ozstesting-pt (npm)
- May 1, 2023
Malware in ozstesting-pt
1 compromised version
- May 1, 2023
Malicious code in danikpack (npm)
- May 1, 2023
Malware in danikpack
1 compromised version
- May 1, 2023
Malicious code in sendtelegram (npm)
- May 1, 2023
Malicious code in apitelegram (npm)
- May 1, 2023
Malware in apitelegram
1 compromised version
- May 1, 2023
Malware in sendtelegram
1 compromised version
- May 1, 2023
Malicious code in zsbpwebsdktest3 (npm)
3 compromised versions
- May 1, 2023
Malicious code in compositionupdate (npm)
1 compromised version
- May 1, 2023
Malicious code in jumflot (npm)
1 compromised version
- May 1, 2023
Malicious code in sovrin-networks (npm)
1 compromised version
- May 1, 2023
Malicious code in editor-layer-index (npm)
3 compromised versions
- May 1, 2023
Malicious code in texture-allocator (npm)
2 compromised versions
- May 1, 2023
Malicious code in eslint-plugin-indeed (npm)
2 compromised versions
- May 1, 2023
Malicious code in ing-orange-lu-luxtrust-oaw-mobile-authentication (npm)
- May 1, 2023
Malware in ing-orange-lu-luxtrust-oaw-mobile-authentication
1 compromised version
- May 1, 2023
Malicious code in skyscanner-themes (npm)
1 compromised version
- Apr 30, 2023
Malicious code in zsbpwebsdktest (npm)
5 compromised versions
- Apr 30, 2023
Malicious code in smart-commons (npm)
8 compromised versions
- Apr 30, 2023
Malicious code in ladoputi-static (npm)
1 compromised version
- Apr 29, 2023
Malicious code in apache2 (npm)
1 compromised version
- Apr 29, 2023
Malicious code in egstore-carousel (npm)
3 compromised versions
- Apr 29, 2023
Malicious code in dist-web (npm)
2 compromised versions
- Apr 29, 2023
Malicious code in plain-function (npm)
2 compromised versions
- Apr 29, 2023
Malicious code in twinmotion (npm)
2 compromised versions
- Apr 29, 2023
Malicious code in commentrating (npm)
2 compromised versions
- Apr 29, 2023
Malicious code in diesel-site (npm)
2 compromised versions
- Apr 29, 2023
Malicious code in flp_hk (npm)
1 compromised version
Page 6325 of 6,645