Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,218 total in npm · sorted newest first- Apr 25, 2023
Malware in schema2x-annotations
1 compromised version
- Apr 25, 2023
Malicious code in grunt-heremaps-build (npm)
- Apr 25, 2023
Malware in grunt-heremaps-build
1 compromised version
- Apr 25, 2023
Malicious code in w_sox (npm)
1 compromised version
- Apr 24, 2023
Malicious code in coinsbot (npm)
- Apr 24, 2023
Malicious code in zebilamouche (npm)
- Apr 24, 2023
Malware in zebilamouche
1 compromised version
- Apr 24, 2023
Malware in coinsbot
1 compromised version
- Apr 24, 2023
Malicious code in b64-svn (npm)
- Apr 24, 2023
Malware in b64-svn
1 compromised version
- Apr 24, 2023
Malware in tetete12312
1 compromised version
- Apr 21, 2023
Malicious code in @esmpfrontend/ui (npm)
- Apr 21, 2023
Malware in @esmpfrontend/ui
1 compromised version
- Apr 21, 2023
Malicious code in airbp-cards (npm)
- Apr 21, 2023
Malware in airbp-cards
1 compromised version
- Apr 21, 2023
Malicious code in charlie-sql-designer (npm)
- Apr 21, 2023
Malware in charlie-sql-designer
1 compromised version
- Apr 20, 2023
Malicious code in tetete12312 (npm)
1 compromised version
- Apr 20, 2023
Malicious code in neat_clean (npm)
- Apr 20, 2023
Malware in neat_clean
1 compromised version
- Apr 20, 2023
Malicious code in utils-dust (npm)
- Apr 20, 2023
Malicious code in rocketship-validator (npm)
- Apr 20, 2023
Malicious code in react-pop-tooltip (npm)
- Apr 20, 2023
Malicious code in photos-story-animator (npm)
- Apr 20, 2023
Malicious code in oc-ccm-module-client (npm)
- Apr 20, 2023
Malicious code in oc-active-conversation-module-client (npm)
- Apr 20, 2023
Malicious code in nodebb-plugin-sso-auto-login (npm)
- Apr 20, 2023
Malicious code in legoland-sdk (npm)
- Apr 20, 2023
Malicious code in group-management (npm)
- Apr 20, 2023
Malware in photos-story-animator
1 compromised version
- Apr 20, 2023
Malware in oc-active-conversation-module-client
1 compromised version
- Apr 20, 2023
Malware in utils-dust
1 compromised version
- Apr 20, 2023
Malware in rocketship-validator
1 compromised version
- Apr 20, 2023
Malware in oc-ccm-module-client
1 compromised version
- Apr 20, 2023
Malware in react-pop-tooltip
1 compromised version
- Apr 20, 2023
Malware in nodebb-plugin-sso-auto-login
1 compromised version
- Apr 20, 2023
Malware in group-management
1 compromised version
- Apr 20, 2023
Malware in legoland-sdk
1 compromised version
- Apr 19, 2023
Malicious code in iconfront (npm)
1 compromised version
- Apr 19, 2023
Malicious code in update.electronjs.org (npm)
1 compromised version
- Apr 19, 2023
Malicious code in il-shopify-osm-types (npm)
8 compromised versions
- Apr 19, 2023
Malware in il-shopify-osm-types
1 compromised version
- Apr 19, 2023
Malicious code in provisioner (npm)
- Apr 19, 2023
Malware in provisioner
1 compromised version
- Apr 18, 2023
Malicious code in pyautodllxd (npm)
- Apr 18, 2023
Malicious code in vibranced (npm)
17 compromised versions
- Apr 18, 2023
Malware in vibranced
1 compromised version
- Apr 18, 2023
Malicious code in dapifix (npm)
- Apr 18, 2023
Malware in dapifix
1 compromised version
- Apr 18, 2023
Malicious code in sendgram (npm)
Page 6327 of 6,645