Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,071 total in npm · sorted newest first- Jan 30, 2023
Malicious code in yandex-meteo-flow (npm)
- Jan 30, 2023
Malicious code in wrf-grid-setup (npm)
- Jan 30, 2023
Malicious code in wrf-distribute (npm)
- Jan 30, 2023
Malicious code in tvmauth (npm)
1 compromised version
- Jan 30, 2023
Malicious code in trust-utils (npm)
- Jan 30, 2023
Malicious code in ticket-parser2 (npm)
1 compromised version
- Jan 30, 2023
Malicious code in statbox-bindings2 (npm)
- Jan 30, 2023
Malicious code in startrek-client (npm)
1 compromised version
- Jan 30, 2023
Malicious code in python-statface-client (npm)
1 compromised version
- Jan 30, 2023
Malicious code in django-yauth (npm)
1 compromised version
- Jan 30, 2023
Malicious code in ytreader (npm)
1 compromised version
- Jan 30, 2023
Malware in django-yauth
1 compromised version
- Jan 30, 2023
Malware in wrf-distribute
1 compromised version
- Jan 30, 2023
Malware in yandex-meteo-flow
1 compromised version
- Jan 30, 2023
Malware in yb-trust-butils
1 compromised version
- Jan 30, 2023
Malware in statbox-bindings2
1 compromised version
- Jan 30, 2023
Malware in ytreader
1 compromised version
- Jan 30, 2023
Malware in yb-mongoengine
1 compromised version
- Jan 30, 2023
Malware in ticket-parser2
1 compromised version
- Jan 30, 2023
Malware in startrek-client
1 compromised version
- Jan 30, 2023
Malware in yandex-passport-vault-client
1 compromised version
- Jan 30, 2023
Malware in yandex-yt-driver-rpc-bindings
1 compromised version
- Jan 30, 2023
Malware in trust-utils
1 compromised version
- Jan 30, 2023
Malware in yandex-text-processing
1 compromised version
- Jan 30, 2023
Malware in tvmauth
1 compromised version
- Jan 30, 2023
Malware in python-statface-client
1 compromised version
- Jan 30, 2023
Malware in yandex-yt-proto
1 compromised version
- Jan 30, 2023
Malware in wrf-grid-setup
1 compromised version
- Jan 30, 2023
Malicious code in yandex-yt-yson-bindings (npm)
1 compromised version
- Jan 30, 2023
Malicious code in yandex-yt-transfer-manager-client (npm)
1 compromised version
- Jan 30, 2023
Malicious code in ticket-parser2-py3 (npm)
1 compromised version
- Jan 30, 2023
Malicious code in qb2-core (npm)
1 compromised version
- Jan 30, 2023
Malicious code in nirvana-api (npm)
1 compromised version
- Jan 30, 2023
Malicious code in kikimrclient (npm)
1 compromised version
- Jan 30, 2023
Malicious code in errorboosterclient (npm)
1 compromised version
- Jan 30, 2023
Malicious code in django-template-common (npm)
1 compromised version
- Jan 30, 2023
Malicious code in django-pgaas (npm)
1 compromised version
- Jan 30, 2023
Malicious code in django-idm-api (npm)
1 compromised version
- Jan 30, 2023
Malicious code in cyson (npm)
1 compromised version
- Jan 30, 2023
Malicious code in catapulse (npm)
1 compromised version
- Jan 30, 2023
Malware in django-pgaas
1 compromised version
- Jan 30, 2023
Malware in yandex-yt-transfer-manager-client
1 compromised version
- Jan 30, 2023
Malware in yandex-yt-yson-bindings
1 compromised version
- Jan 30, 2023
Malware in catapulse
1 compromised version
- Jan 30, 2023
Malware in errorboosterclient
1 compromised version
- Jan 30, 2023
Malware in cyson
1 compromised version
- Jan 30, 2023
Malware in kikimrclient
1 compromised version
- Jan 30, 2023
Malware in django-template-common
1 compromised version
- Jan 30, 2023
Malware in django-idm-api
1 compromised version
- Jan 30, 2023
Malware in qb2-core
1 compromised version
Page 6340 of 6,642