Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,214 total in npm · sorted newest first- Feb 2, 2023
Malware in johnnygaddarr
1 compromised version
- Feb 2, 2023
Malware in status-proxy
1 compromised version
- Feb 2, 2023
Malware in pooled-redis
1 compromised version
- Feb 2, 2023
Malware in mypy-action
1 compromised version
- Feb 2, 2023
Malicious code in tokenlon-v5-subgraph (npm)
1 compromised version
- Feb 2, 2023
Malicious code in swisspost (npm)
1 compromised version
- Feb 2, 2023
Malicious code in stats-collect-components (npm)
1 compromised version
- Feb 2, 2023
Malicious code in solc-0.8 (npm)
1 compromised version
- Feb 2, 2023
Malicious code in nayduck (npm)
3 compromised versions
- Feb 2, 2023
Malicious code in gateleen-hook-js (npm)
1 compromised version
- Feb 2, 2023
Malicious code in dvf-utils (npm)
- Feb 2, 2023
Malicious code in cryptotickets (npm)
1 compromised version
- Feb 2, 2023
Malicious code in climate-warehouse (npm)
1 compromised version
- Feb 2, 2023
Malware in solc-0.8
1 compromised version
- Feb 2, 2023
Malware in nayduck
1 compromised version
- Feb 2, 2023
Malware in swisspost
1 compromised version
- Feb 2, 2023
Malware in cryptotickets
1 compromised version
- Feb 2, 2023
Malware in climate-warehouse
1 compromised version
- Feb 2, 2023
Malware in stats-collect-components
1 compromised version
- Feb 2, 2023
Malware in dvf-utils
1 compromised version
- Feb 2, 2023
Malware in gateleen-hook-js
1 compromised version
- Feb 2, 2023
Malware in tokenlon-v5-subgraph
1 compromised version
- Feb 2, 2023
Malicious code in flip-flip-flip (npm)
- Feb 2, 2023
Malware in flip-flip-flip
1 compromised version
- Feb 1, 2023
Malicious code in angular-1.8 (npm)
- Jan 31, 2023
Malicious code in waline-magic (npm)
- Jan 31, 2023
Malicious code in twikoo-magic (npm)
- Jan 31, 2023
Malicious code in tohe-update (npm)
- Jan 31, 2023
Malicious code in tohe-doc-resources (npm)
- Jan 31, 2023
Malicious code in toh-doc-files (npm)
2 compromised versions
- Jan 31, 2023
Malicious code in hexo-static (npm)
- Jan 31, 2023
Malware in toh-doc-files
1 compromised version
- Jan 31, 2023
Malware in twikoo-magic
1 compromised version
- Jan 31, 2023
Malware in waline-magic
1 compromised version
- Jan 31, 2023
Malware in tohe-update
1 compromised version
- Jan 31, 2023
Malware in tohe-doc-resources
1 compromised version
- Jan 31, 2023
Malware in hexo-static
1 compromised version
- Jan 31, 2023
Malicious code in angular-mocks-1.8 (npm)
1 compromised version
- Jan 31, 2023
Malware in angular-mocks-1.8
1 compromised version
- Jan 31, 2023
Malicious code in gatorcomponents (npm)
- Jan 31, 2023
Malware in gatorcomponents
1 compromised version
- Jan 31, 2023
Malicious code in dpcf-test (npm)
- Jan 31, 2023
Malware in dpcf-test
1 compromised version
- Jan 30, 2023
Malicious code in vscode-smoketest-express (npm)
- Jan 30, 2023
Malicious code in tropine_1 (npm)
- Jan 30, 2023
Malicious code in railties (npm)
- Jan 30, 2023
Malicious code in pxt-arcade-sim (npm)
- Jan 30, 2023
Malware in pxt-arcade-sim
1 compromised version
- Jan 30, 2023
Malware in tropine_1
1 compromised version
- Jan 30, 2023
Malware in vscode-smoketest-express
1 compromised version
Page 6339 of 6,645