Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,214 total in npm · sorted newest first- Jan 9, 2023
Malware in @playgami/portal-logs
1 compromised version
- Jan 9, 2023
Malware in @playgami/portal-dynamic-copy
1 compromised version
- Jan 9, 2023
Malware in @playgami/eslint-config-portal-typescript
1 compromised version
- Jan 9, 2023
Malicious code in donuts.node-remote (npm)
- Jan 9, 2023
Malicious code in central-ui-component (npm)
- Jan 9, 2023
Malware in donuts.node-remote
1 compromised version
- Jan 9, 2023
Malware in central-ui-component
1 compromised version
- Jan 9, 2023
Malicious code in market-apps-list (npm)
- Jan 9, 2023
Malware in market-apps-list
1 compromised version
- Jan 9, 2023
Malicious code in test-guro (npm)
- Jan 9, 2023
Malware in test-guro
1 compromised version
- Jan 6, 2023
Malicious code in chokidar-next (npm)
- Jan 6, 2023
Malware in chokidar-next
1 compromised version
- Dec 29, 2022
Malicious code in node-kexec (npm)
- Dec 29, 2022
Malicious code in chart.js-latest (npm)
- Dec 29, 2022
Malware in chart.js-latest
1 compromised version
- Dec 29, 2022
Malware in node-kexec
1 compromised version
- Dec 29, 2022
Malicious code in shuup-definite-theme (npm)
- Dec 29, 2022
Malicious code in reactjs-slick (npm)
- Dec 29, 2022
Malicious code in phup.js (npm)
- Dec 29, 2022
Malicious code in phup (npm)
- Dec 29, 2022
Malware in phup
1 compromised version
- Dec 29, 2022
Malware in reactjs-slick
1 compromised version
- Dec 29, 2022
Malware in shuup-definite-theme
1 compromised version
- Dec 29, 2022
Malware in phup.js
1 compromised version
- Dec 29, 2022
Malicious code in xrpl-org-dev-portal (npm)
- Dec 29, 2022
Malicious code in sponsor-jobs (npm)
- Dec 29, 2022
Malicious code in seaport-gossip (npm)
- Dec 29, 2022
Malicious code in rippleadminconsole (npm)
- Dec 29, 2022
Malicious code in big-design (npm)
- Dec 29, 2022
Malware in big-design
1 compromised version
- Dec 29, 2022
Malware in seaport-gossip
1 compromised version
- Dec 29, 2022
Malware in rippleadminconsole
1 compromised version
- Dec 29, 2022
Malware in sponsor-jobs
1 compromised version
- Dec 29, 2022
Malware in xrpl-org-dev-portal
1 compromised version
- Dec 29, 2022
Malicious code in rum-speedindex (npm)
- Dec 29, 2022
Malware in rum-speedindex
1 compromised version
- Dec 29, 2022
Malicious code in rmgjs-lib (npm)
- Dec 29, 2022
Malicious code in prova-admin (npm)
- Dec 29, 2022
Malicious code in bcashjs-lib (npm)
- Dec 29, 2022
Malware in rmgjs-lib
1 compromised version
- Dec 29, 2022
Malware in bcashjs-lib
1 compromised version
- Dec 29, 2022
Malware in prova-admin
1 compromised version
- Dec 29, 2022
Malicious code in usaa-typography (npm)
- Dec 29, 2022
Malicious code in usaa-form (npm)
- Dec 29, 2022
Malicious code in usaa-datepicker (npm)
- Dec 29, 2022
Malicious code in usaa-colors (npm)
- Dec 29, 2022
Malicious code in ent-cas-form-navigation-buttons (npm)
- Dec 29, 2022
Malware in usaa-datepicker
1 compromised version
- Dec 29, 2022
Malware in usaa-colors
1 compromised version
Page 6348 of 6,645