Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,214 total in npm · sorted newest first- Dec 29, 2022
Malware in usaa-typography
1 compromised version
- Dec 29, 2022
Malware in ent-cas-form-navigation-buttons
1 compromised version
- Dec 29, 2022
Malware in usaa-form
1 compromised version
- Dec 21, 2022
Malicious code in niroborg-npm-com-test (npm)
- Dec 21, 2022
Malicious code in niroborg-com-test (npm)
- Dec 19, 2022
Malicious code in experience-template-renderer-react (npm)
- Dec 19, 2022
Malicious code in eg-auth-ui-localization (npm)
- Dec 19, 2022
Malware in experience-template-renderer-react
1 compromised version
- Dec 19, 2022
Malware in eg-auth-ui-localization
1 compromised version
- Dec 19, 2022
Malicious code in arpanrizki-panpan (npm)
- Dec 19, 2022
Malware in arpanrizki-panpan
1 compromised version
- Dec 15, 2022
Malicious code in mrpackage1-npm (npm)
- Dec 15, 2022
Malicious code in gramin-chat1 (npm)
- Dec 15, 2022
Malware in mrpackage1-npm
1 compromised version
- Dec 15, 2022
Malware in gramin-chat1
1 compromised version
- Dec 14, 2022
Malicious code in reload-update-cookies-ahref.com (npm)
- Dec 14, 2022
Malware in reload-update-cookies-ahref.com
1 compromised version
- Dec 13, 2022
Malicious code in test-pls (npm)
- Dec 13, 2022
Malware in test-pls
1 compromised version
- Dec 13, 2022
Malicious code in @proofpoint/fuse-ui (npm)
- Dec 13, 2022
Malware in @proofpoint/fuse-ui
1 compromised version
- Dec 12, 2022
Malicious code in ng-component-library (npm)
- Dec 12, 2022
Malware in ng-component-library
1 compromised version
- Dec 12, 2022
Malicious code in tuikit (npm)
- Dec 12, 2022
Malicious code in tsconfig-package (npm)
- Dec 12, 2022
Malicious code in caliper-publish (npm)
- Dec 12, 2022
Malicious code in aries-bifold (npm)
- Dec 12, 2022
Malware in aries-bifold
1 compromised version
- Dec 12, 2022
Malware in tuikit
1 compromised version
- Dec 12, 2022
Malware in caliper-publish
1 compromised version
- Dec 12, 2022
Malware in tsconfig-package
1 compromised version
- Dec 12, 2022
Malicious code in teleterm (npm)
- Dec 12, 2022
Malicious code in setup-gamma (npm)
- Dec 12, 2022
Malware in teleterm
1 compromised version
- Dec 12, 2022
Malware in setup-gamma
1 compromised version
- Dec 12, 2022
Malicious code in preply-riddle-online-status (npm)
- Dec 12, 2022
Malware in preply-riddle-online-status
1 compromised version
- Dec 12, 2022
Malicious code in inex-mixins (npm)
- Dec 12, 2022
Malware in inex-mixins
1 compromised version
- Dec 9, 2022
Malicious code in yf_hello_world (npm)
- Dec 9, 2022
Malware in yf_hello_world
1 compromised version
- Dec 7, 2022
Malicious code in read.node (npm)
- Dec 7, 2022
Malicious code in --hiljson (npm)
- Dec 7, 2022
Malicious code in bluebird.node (npm)
- Dec 7, 2022
Malware in --hiljson
1 compromised version
- Dec 7, 2022
Malware in bluebird.node
1 compromised version
- Dec 7, 2022
Malware in read.node
1 compromised version
- Dec 7, 2022
Malicious code in testherejson (npm)
- Dec 7, 2022
Malicious code in securityrele (npm)
- Dec 7, 2022
Malicious code in hiljsonhil (npm)
Page 6349 of 6,645