Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,214 total in npm · sorted newest first- Jan 11, 2023
Malicious code in github-actions-slack (npm)
- Jan 11, 2023
Malicious code in create-or-update-comment (npm)
- Jan 11, 2023
Malicious code in bucko (npm)
- Jan 11, 2023
Malicious code in asdtestaaa (npm)
- Jan 11, 2023
Malware in sa-docs-to-json
1 compromised version
- Jan 11, 2023
Malware in setup-maven
1 compromised version
- Jan 11, 2023
Malware in asdtestaaa
1 compromised version
- Jan 11, 2023
Malware in create-or-update-comment
1 compromised version
- Jan 11, 2023
Malware in hiring-without-whiteboards
1 compromised version
- Jan 11, 2023
Malware in github-actions-slack
1 compromised version
- Jan 11, 2023
Malware in bucko
1 compromised version
- Jan 11, 2023
Malware in action-electron-builder
1 compromised version
- Jan 11, 2023
Malware in identity-demo
1 compromised version
- Jan 11, 2023
Malware in tradeshift-ui-docs
1 compromised version
- Jan 11, 2023
Malware in action-surefire-report
1 compromised version
- Jan 11, 2023
Malicious code in lmru-pilot-main (npm)
- Jan 11, 2023
Malware in lmru-pilot-main
1 compromised version
- Jan 10, 2023
Malicious code in web-pairing-kit (npm)
- Jan 10, 2023
Malicious code in agicap (npm)
- Jan 10, 2023
Malware in web-pairing-kit
1 compromised version
- Jan 10, 2023
Malware in agicap
1 compromised version
- Jan 10, 2023
Malicious code in agent-core (npm)
- Jan 10, 2023
Malware in agent-core
1 compromised version
- Jan 10, 2023
Malicious code in coolblue-assets (npm)
- Jan 10, 2023
Malware in coolblue-assets
1 compromised version
- Jan 10, 2023
Malicious code in stake.fish (npm)
- Jan 10, 2023
Malicious code in pancakeswap.com (npm)
- Jan 10, 2023
Malicious code in ftx.com (npm)
- Jan 10, 2023
Malicious code in everstake.one (npm)
- Jan 10, 2023
Malicious code in dextools.io (npm)
- Jan 10, 2023
Malware in dextools.io
1 compromised version
- Jan 10, 2023
Malware in pancakeswap.com
1 compromised version
- Jan 10, 2023
Malware in ftx.com
1 compromised version
- Jan 10, 2023
Malware in stake.fish
1 compromised version
- Jan 10, 2023
Malware in everstake.one
1 compromised version
- Jan 10, 2023
Malicious code in frappe-framework (npm)
- Jan 10, 2023
Malware in frappe-framework
1 compromised version
- Jan 10, 2023
Malicious code in dependancy_confusion_test_tal3 (npm)
- Jan 10, 2023
Malicious code in dependancy_confusion_test_tal2 (npm)
- Jan 10, 2023
Malicious code in dependancy_confusion_test_tal (npm)
- Jan 10, 2023
Malicious code in dependancy_confusion_test2 (npm)
- Jan 10, 2023
Malicious code in dep_pre_install_v3 (npm)
- Jan 10, 2023
Malicious code in dep_pre_install_v2 (npm)
- Jan 10, 2023
Malicious code in dep_conf_tal2 (npm)
- Jan 10, 2023
Malicious code in dep-conf-test-tal2 (npm)
- Jan 10, 2023
Malicious code in dep-conf-test-tal (npm)
- Jan 10, 2023
Malware in dependancy_confusion_test2
1 compromised version
- Jan 10, 2023
Malware in dep_pre_install_v2
1 compromised version
- Jan 10, 2023
Malware in dependancy_confusion_test_tal3
1 compromised version
- Jan 10, 2023
Malware in dependancy_confusion_test_tal2
1 compromised version
Page 6346 of 6,645