Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,214 total in npm · sorted newest first- Feb 13, 2023
Malicious code in doii.repo.tik (npm)
- Feb 13, 2023
Malicious code in doii.repo (npm)
- Feb 13, 2023
Malware in doii.repo.tik
1 compromised version
- Feb 13, 2023
Malware in doii.repo
1 compromised version
- Feb 12, 2023
Malicious code in eslint-plugin-dropbox-sign (npm)
2 compromised versions
- Feb 12, 2023
Malware in eslint-plugin-dropbox-sign
1 compromised version
- Feb 12, 2023
Malicious code in mdes_digital_enablement_api (npm)
- Feb 12, 2023
Malware in mdes_digital_enablement_api
1 compromised version
- Feb 12, 2023
Malicious code in fca-jiser-remake (npm)
- Feb 12, 2023
Malware in fca-jiser-remake
1 compromised version
- Feb 12, 2023
Malicious code in synthetic-jiser-database (npm)
- Feb 12, 2023
Malicious code in jiser-sp (npm)
- Feb 12, 2023
Malicious code in fca-jiserdz (npm)
- Feb 12, 2023
Malicious code in fca-jiser (npm)
- Feb 12, 2023
Malware in jiser-sp
1 compromised version
- Feb 12, 2023
Malware in fca-jiser
1 compromised version
- Feb 12, 2023
Malware in synthetic-jiser-database
1 compromised version
- Feb 12, 2023
Malware in fca-jiserdz
1 compromised version
- Feb 12, 2023
Malicious code in wf-extract-text-in-image2 (npm)
- Feb 12, 2023
Malicious code in micro-username (npm)
35 compromised versions
- Feb 12, 2023
Malware in wf-extract-text-in-image2
1 compromised version
- Feb 12, 2023
Malware in micro-username
1 compromised version
- Feb 9, 2023
Malicious code in @superbet-group/web.lib.config (npm)
- Feb 9, 2023
Malicious code in @superbet-group/allowances-js (npm)
- Feb 9, 2023
Malware in @superbet-group/web.lib.config
1 compromised version
- Feb 9, 2023
Malware in @superbet-group/allowances-js
1 compromised version
- Feb 9, 2023
Malicious code in @superbet-group/web.types (npm)
- Feb 9, 2023
Malicious code in @superbet-group/web.lib.vue-utilities (npm)
- Feb 9, 2023
Malicious code in @superbet-group/web.lib.utilities (npm)
- Feb 9, 2023
Malicious code in @superbet-group/web.lib.rest (npm)
- Feb 9, 2023
Malicious code in @superbet-group/web.lib.global-styles (npm)
- Feb 9, 2023
Malicious code in @superbet-group/web.lib.flags (npm)
- Feb 9, 2023
Malicious code in @superbet-group/martech.lib.google-analytics (npm)
- Feb 9, 2023
Malicious code in @superbet-group/betting.lib.payments (npm)
- Feb 9, 2023
Malware in @superbet-group/web.types
1 compromised version
- Feb 9, 2023
Malware in @superbet-group/web.lib.global-styles
1 compromised version
- Feb 9, 2023
Malware in @superbet-group/web.lib.vue-utilities
1 compromised version
- Feb 9, 2023
Malware in @superbet-group/martech.lib.google-analytics
1 compromised version
- Feb 9, 2023
Malware in @superbet-group/web.lib.utilities
1 compromised version
- Feb 9, 2023
Malware in @superbet-group/web.lib.flags
1 compromised version
- Feb 9, 2023
Malware in @superbet-group/betting.lib.payments
1 compromised version
- Feb 9, 2023
Malware in @superbet-group/web.lib.rest
1 compromised version
- Feb 9, 2023
Malicious code in @chegg/wtai-upload-widget (npm)
2 compromised versions
- Feb 9, 2023
Malware in @chegg/wtai-upload-widget
1 compromised version
- Feb 9, 2023
Malicious code in usamaturk1 (npm)
1 compromised version
- Feb 9, 2023
Malicious code in usamaturk (npm)
1 compromised version
- Feb 9, 2023
Malware in usamaturk
1 compromised version
- Feb 9, 2023
Malware in usamaturk1
1 compromised version
- Feb 8, 2023
Malicious code in fronton-react (npm)
- Feb 8, 2023
Malware in fronton-react
1 compromised version
Page 6336 of 6,645