Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,218 total in npm · sorted newest first- Apr 3, 2023
Malware in gd-apply
1 compromised version
- Apr 3, 2023
Malware in gd-login
1 compromised version
- Apr 3, 2023
Malicious code in gd-testtesttest (npm)
- Apr 3, 2023
Malware in gd-testtesttest
1 compromised version
- Apr 3, 2023
Malicious code in vscode-github-actions (npm)
- Apr 3, 2023
Malware in vscode-github-actions
1 compromised version
- Apr 3, 2023
Malicious code in @12build/segment-js-sdk (npm)
- Apr 3, 2023
Malicious code in @12build/product-api-ts-axios-sdk (npm)
- Apr 3, 2023
Malicious code in @12build/account-api-ts-axios-sdk (npm)
- Apr 3, 2023
Malware in @12build/segment-js-sdk
1 compromised version
- Apr 3, 2023
Malware in @12build/account-api-ts-axios-sdk
1 compromised version
- Apr 3, 2023
Malware in @12build/product-api-ts-axios-sdk
1 compromised version
- Mar 31, 2023
Malicious code in yahoodotcom-layout (npm)
- Mar 31, 2023
Malicious code in tdv2-service-profile (npm)
- Mar 31, 2023
Malicious code in tdv2-service-ads (npm)
- Mar 31, 2023
Malicious code in tdv2-applet-video-modal (npm)
- Mar 31, 2023
Malicious code in tdv2-applet-userintent (npm)
- Mar 31, 2023
Malicious code in tdv2-applet-uh (npm)
- Mar 31, 2023
Malicious code in tdv2-applet-stream-her (npm)
- Mar 31, 2023
Malicious code in tdv2-applet-stream (npm)
- Mar 31, 2023
Malicious code in tdv2-applet-sports-media (npm)
- Mar 31, 2023
Malicious code in tdv2-applet-search-input (npm)
- Mar 31, 2023
Malicious code in tdv2-applet-navrail (npm)
- Mar 31, 2023
Malicious code in tdv2-applet-monalixa.store (npm)
- Mar 31, 2023
Malicious code in tdv2-applet-featurebar (npm)
- Mar 31, 2023
Malicious code in tdv2-applet-account-switch (npm)
- Mar 31, 2023
Malicious code in td-service-canvas (npm)
- Mar 31, 2023
Malicious code in td-app-finance (npm)
- Mar 31, 2023
Malicious code in react-sports-utils (npm)
- Mar 31, 2023
Malicious code in react-sports (npm)
- Mar 31, 2023
Malicious code in lupinfakepackagingforscanners (npm)
- Mar 31, 2023
Malicious code in grouped-content (npm)
- Mar 31, 2023
Malicious code in ds-ember-sample (npm)
- Mar 31, 2023
Malicious code in caas-canvas (npm)
- Mar 31, 2023
Malicious code in caas-assembly (npm)
- Mar 31, 2023
Malware in tdv2-applet-video-modal
1 compromised version
- Mar 31, 2023
Malware in react-sports
1 compromised version
- Mar 31, 2023
Malware in caas-assembly
1 compromised version
- Mar 31, 2023
Malware in tdv2-applet-userintent
1 compromised version
- Mar 31, 2023
Malware in caas-canvas
1 compromised version
- Mar 31, 2023
Malware in tdv2-applet-stream-her
1 compromised version
- Mar 31, 2023
Malware in tdv2-applet-monalixa.store
1 compromised version
- Mar 31, 2023
Malware in tdv2-applet-featurebar
1 compromised version
- Mar 31, 2023
Malware in td-app-finance
1 compromised version
- Mar 31, 2023
Malware in ds-ember-sample
1 compromised version
- Mar 31, 2023
Malware in react-sports-utils
1 compromised version
- Mar 31, 2023
Malware in tdv2-service-profile
1 compromised version
- Mar 31, 2023
Malware in yahoodotcom-layout
1 compromised version
- Mar 31, 2023
Malware in grouped-content
1 compromised version
- Mar 31, 2023
Malware in td-service-canvas
1 compromised version
Page 6330 of 6,645