Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,214 total in npm · sorted newest first- Jan 30, 2023
Malware in proxy-stub-utils
1 compromised version
- Jan 30, 2023
Malware in karma-i-ua
1 compromised version
- Jan 30, 2023
Malware in staff-api
1 compromised version
- Jan 30, 2023
Malicious code in yandex-global-state-controller (npm)
- Jan 30, 2023
Malicious code in wall-e.api (npm)
1 compromised version
- Jan 30, 2023
Malicious code in vh3 (npm)
1 compromised version
- Jan 30, 2023
Malicious code in uniagent27 (npm)
- Jan 30, 2023
Malicious code in testtestkakakalala (npm)
1 compromised version
- Jan 30, 2023
Malicious code in statfacepy (npm)
1 compromised version
- Jan 30, 2023
Malicious code in signurl-bindings (npm)
- Jan 30, 2023
Malicious code in satellite-precipitation-detector (npm)
1 compromised version
- Jan 30, 2023
Malicious code in sandbox-library (npm)
- Jan 30, 2023
Malicious code in sandbox-common (npm)
- Jan 30, 2023
Malicious code in salmonpy (npm)
- Jan 30, 2023
Malicious code in rasp-vault (npm)
- Jan 30, 2023
Malicious code in python-tdigest-bindings (npm)
1 compromised version
- Jan 30, 2023
Malicious code in juggler-sdk (npm)
- Jan 30, 2023
Malicious code in forecastcontainer (npm)
- Jan 30, 2023
Malicious code in eumetcast-gluing (npm)
- Jan 30, 2023
Malicious code in dca-http-searcher (npm)
- Jan 30, 2023
Malware in uniagent27
1 compromised version
- Jan 30, 2023
Malware in sandbox-library
1 compromised version
- Jan 30, 2023
Malware in yandex-global-state-controller
1 compromised version
- Jan 30, 2023
Malware in forecastcontainer
1 compromised version
- Jan 30, 2023
Malware in salmonpy
1 compromised version
- Jan 30, 2023
Malware in wall-e.api
1 compromised version
- Jan 30, 2023
Malware in rasp-vault
1 compromised version
- Jan 30, 2023
Malware in sandbox-common
1 compromised version
- Jan 30, 2023
Malware in vh3
1 compromised version
- Jan 30, 2023
Malware in dca-http-searcher
1 compromised version
- Jan 30, 2023
Malware in statfacepy
1 compromised version
- Jan 30, 2023
Malware in eumetcast-gluing
1 compromised version
- Jan 30, 2023
Malware in satellite-precipitation-detector
1 compromised version
- Jan 30, 2023
Malware in juggler-sdk
1 compromised version
- Jan 30, 2023
Malware in signurl-bindings
1 compromised version
- Jan 30, 2023
Malware in testtestkakakalala
1 compromised version
- Jan 30, 2023
Malware in python-tdigest-bindings
1 compromised version
- Jan 30, 2023
Malicious code in yb-trust-butils (npm)
- Jan 30, 2023
Malicious code in yb-mongoengine (npm)
- Jan 30, 2023
Malicious code in yandex-yt-proto (npm)
- Jan 30, 2023
Malicious code in yandex-yt-driver-rpc-bindings (npm)
- Jan 30, 2023
Malicious code in yandex-text-processing (npm)
- Jan 30, 2023
Malicious code in yandex-passport-vault-client (npm)
1 compromised version
- Jan 30, 2023
Malicious code in yandex-meteo-flow (npm)
- Jan 30, 2023
Malicious code in wrf-grid-setup (npm)
- Jan 30, 2023
Malicious code in wrf-distribute (npm)
- Jan 30, 2023
Malicious code in tvmauth (npm)
1 compromised version
- Jan 30, 2023
Malicious code in trust-utils (npm)
- Jan 30, 2023
Malicious code in ticket-parser2 (npm)
1 compromised version
- Jan 30, 2023
Malicious code in statbox-bindings2 (npm)
Page 6342 of 6,645