Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,214 total in npm · sorted newest first- Jan 18, 2023
Malicious code in speedgun (npm)
- Jan 18, 2023
Malicious code in speedgum (npm)
- Jan 18, 2023
Malicious code in lagra (npm)
- Jan 18, 2023
Malware in speedtestclix
1 compromised version
- Jan 18, 2023
Malware in trovam
1 compromised version
- Jan 18, 2023
Malware in speedtesta
1 compromised version
- Jan 18, 2023
Malware in speedtestcliz
1 compromised version
- Jan 18, 2023
Malware in speedtestgo
1 compromised version
- Jan 18, 2023
Malware in speedtestbom
1 compromised version
- Jan 18, 2023
Malware in speedtestsolo
1 compromised version
- Jan 18, 2023
Malware in speedtestspa
1 compromised version
- Jan 18, 2023
Malware in speedtestkas
1 compromised version
- Jan 18, 2023
Malware in speedtesto
1 compromised version
- Jan 18, 2023
Malware in speedtestis
1 compromised version
- Jan 18, 2023
Malware in speedgun
1 compromised version
- Jan 18, 2023
Malware in speedgum
1 compromised version
- Jan 18, 2023
Malware in speedtestwow
1 compromised version
- Jan 18, 2023
Malware in speedtestgod
1 compromised version
- Jan 18, 2023
Malware in lagra
1 compromised version
- Jan 18, 2023
Malware in trova
1 compromised version
- Jan 18, 2023
Malware in speedtestrun
1 compromised version
- Jan 18, 2023
Malware in speedtestzo
1 compromised version
- Jan 18, 2023
Malware in speedtestfast
1 compromised version
- Jan 17, 2023
Malicious code in cathode-versions-javascript (npm)
- Jan 17, 2023
Malware in cathode-versions-javascript
1 compromised version
- Jan 16, 2023
Malicious code in cync-color (npm)
- Jan 16, 2023
Malware in cync-color
1 compromised version
- Jan 16, 2023
Malicious code in @balea-telefonica/ui (npm)
4 compromised versions
- Jan 16, 2023
Malware in @balea-telefonica/ui
1 compromised version
- Jan 13, 2023
Malicious code in prathooi (npm)
- Jan 13, 2023
Malicious code in prathmi (npm)
- Jan 13, 2023
Malware in prathooi
1 compromised version
- Jan 13, 2023
Malware in prathmi
1 compromised version
- Jan 13, 2023
Malicious code in prathmeshox (npm)
- Jan 13, 2023
Malicious code in lucifoxerox (npm)
- Jan 13, 2023
Malicious code in lucifoxero (npm)
- Jan 13, 2023
Malware in prathmeshox
1 compromised version
- Jan 13, 2023
Malware in lucifoxerox
1 compromised version
- Jan 13, 2023
Malware in lucifoxero
1 compromised version
- Jan 11, 2023
Malicious code in telstra-ui (npm)
- Jan 11, 2023
Malicious code in cas-core-renderer (npm)
- Jan 11, 2023
Malware in telstra-ui
1 compromised version
- Jan 11, 2023
Malware in cas-core-renderer
1 compromised version
- Jan 11, 2023
Malicious code in tradeshift-ui-docs (npm)
- Jan 11, 2023
Malicious code in action-surefire-report (npm)
- Jan 11, 2023
Malicious code in action-electron-builder (npm)
- Jan 11, 2023
Malicious code in setup-maven (npm)
- Jan 11, 2023
Malicious code in sa-docs-to-json (npm)
- Jan 11, 2023
Malicious code in identity-demo (npm)
- Jan 11, 2023
Malicious code in hiring-without-whiteboards (npm)
Page 6345 of 6,645