Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,218 total in npm · sorted newest first- Apr 29, 2023
Malicious code in rb-notification-banner (npm)
1 compromised version
- Apr 29, 2023
Malicious code in scuid-x (npm)
3 compromised versions
- Apr 29, 2023
Malicious code in testforconfusion (npm)
3 compromised versions
- Apr 29, 2023
Malicious code in scuntest (npm)
1 compromised version
- Apr 29, 2023
Malicious code in falsepositivecheck6969 (npm)
1 compromised version
- Apr 29, 2023
Malicious code in zsbpwebsdk (npm)
5 compromised versions
- Apr 29, 2023
Malicious code in donuts.node-build (npm)
6 compromised versions
- Apr 29, 2023
Malicious code in thisisjustfortesting (npm)
1 compromised version
- Apr 28, 2023
Malicious code in @infinitebrahmanuniverse/nolb-cys (npm)
1 compromised version
- Apr 28, 2023
Malicious code in documentation-ably-realtime (npm)
1 compromised version
- Apr 28, 2023
Malicious code in links-3 (npm)
2 compromised versions
- Apr 28, 2023
Malicious code in @hyperion-util/deferred-value (npm)
1 compromised version
- Apr 28, 2023
Malicious code in @hyperion-util/script-loader (npm)
1 compromised version
- Apr 28, 2023
Malicious code in @hyperion-util/cookies (npm)
1 compromised version
- Apr 28, 2023
Malicious code in bjss-atp-web (npm)
1 compromised version
- Apr 27, 2023
Malicious code in fsevents (npm)
- Apr 27, 2023
Malware in fsevents
1 compromised version
- Apr 27, 2023
Malicious code in store-js-sdk (npm)
2 compromised versions
- Apr 27, 2023
Malicious code in parallel-workers (npm)
5 compromised versions
- Apr 27, 2023
Malicious code in redirect-support (npm)
1 compromised version
- Apr 27, 2023
Malicious code in 3a-spawn (npm)
- Apr 27, 2023
Malicious code in 3a-look (npm)
- Apr 27, 2023
Malicious code in algo-svnlook (npm)
- Apr 26, 2023
Malicious code in gtf-error-tracker (npm)
1 compromised version
- Apr 26, 2023
Malicious code in sheer-chat-client (npm)
1 compromised version
- Apr 26, 2023
Malicious code in she-c (npm)
1 compromised version
- Apr 26, 2023
Malicious code in inter-mobile-bridge (npm)
1 compromised version
- Apr 26, 2023
Malicious code in hpackeyboard-core (npm)
1 compromised version
- Apr 26, 2023
Malicious code in @expressions/excel-functions (npm)
1 compromised version
- Apr 26, 2023
Malicious code in react-div-100vh-test (npm)
1 compromised version
- Apr 26, 2023
Malicious code in ssh-compute (npm)
2 compromised versions
- Apr 26, 2023
Malicious code in loveslack (npm)
1 compromised version
- Apr 26, 2023
Malicious code in loveapple (npm)
1 compromised version
- Apr 26, 2023
Malicious code in nodejs-encrypt-agent (npm)
4 compromised versions
- Apr 26, 2023
Malicious code in nodejs-cookie-proxy-agent (npm)
6 compromised versions
- Apr 26, 2023
Malware in nodejs-encrypt-agent
1 compromised version
- Apr 26, 2023
Malware in nodejs-cookie-proxy-agent
1 compromised version
- Apr 26, 2023
Malicious code in apnic-ui (npm)
14 compromised versions
- Apr 26, 2023
Malware in apnic-ui
1 compromised version
- Apr 26, 2023
Malicious code in mpc-ap-styles (npm)
4 compromised versions
- Apr 26, 2023
Malicious code in algo-svnspawn (npm)
- Apr 25, 2023
Malicious code in here-cicd (npm)
- Apr 25, 2023
Malware in here-cicd
1 compromised version
- Apr 25, 2023
Malicious code in nlp-react-native (npm)
- Apr 25, 2023
Malware in nlp-react-native
1 compromised version
- Apr 25, 2023
Malicious code in reality-lens-sdk (npm)
- Apr 25, 2023
Malware in reality-lens-sdk
1 compromised version
- Apr 25, 2023
Malicious code in schema2x (npm)
- Apr 25, 2023
Malware in schema2x
1 compromised version
- Apr 25, 2023
Malicious code in schema2x-annotations (npm)
Page 6326 of 6,645