Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,214 total in npm · sorted newest first- Nov 25, 2022
Malicious code in @vendavo/not-pezzi (npm)
- Nov 25, 2022
Malware in @vendavo/not-pezzi
1 compromised version
- Nov 25, 2022
Malware in @vendavo/pezzi
1 compromised version
- Nov 23, 2022
Malicious code in wangwanqi-tools (npm)
- Nov 23, 2022
Malicious code in vue2-wangwanqi (npm)
- Nov 23, 2022
Malware in wangwanqi-tools
1 compromised version
- Nov 23, 2022
Malware in vue2-wangwanqi
1 compromised version
- Nov 22, 2022
Malicious code in cvs-components (npm)
- Nov 22, 2022
Malicious code in cvs-codestyle (npm)
- Nov 22, 2022
Malware in cvs-codestyle
1 compromised version
- Nov 22, 2022
Malware in cvs-components
1 compromised version
- Nov 21, 2022
Malicious code in install-utils (npm)
- Nov 21, 2022
Malware in install-utils
1 compromised version
- Nov 21, 2022
Malicious code in man-installer (npm)
- Nov 21, 2022
Malware in man-installer
1 compromised version
- Nov 18, 2022
Malicious code in font-firasans (npm)
- Nov 18, 2022
Malware in font-firasans
1 compromised version
- Nov 18, 2022
Malicious code in @upc2web/font-firasans (npm)
- Nov 18, 2022
Malware in @upc2web/font-firasans
1 compromised version
- Nov 17, 2022
Malicious code in geocomponents (npm)
- Nov 17, 2022
Malicious code in babel-preset-geocaching (npm)
- Nov 17, 2022
Malware in babel-preset-geocaching
1 compromised version
- Nov 17, 2022
Malware in geocomponents
1 compromised version
- Nov 17, 2022
Malicious code in geocaching-express-account-middleware (npm)
- Nov 17, 2022
Malware in geocaching-express-account-middleware
1 compromised version
- Nov 16, 2022
Malicious code in ul-mailru (npm)
- Nov 16, 2022
Malware in ul-mailru
1 compromised version
- Nov 15, 2022
Malicious code in test-inherited-attrs (npm)
- Nov 15, 2022
Malicious code in internal-lib-build (npm)
- Nov 15, 2022
Malicious code in commerce-sdk-react (npm)
- Nov 15, 2022
Malware in test-inherited-attrs
1 compromised version
- Nov 15, 2022
Malware in internal-lib-build
1 compromised version
- Nov 15, 2022
Malware in commerce-sdk-react
1 compromised version
- Nov 14, 2022
Malicious code in coloramajs (npm)
- Nov 14, 2022
Malicious code in bot-discord-js (npm)
- Nov 14, 2022
Malware in bot-discord-js
1 compromised version
- Nov 14, 2022
Malware in coloramajs
1 compromised version
- Nov 14, 2022
Malicious code in nab-chat-widget (npm)
- Nov 14, 2022
Malware in nab-chat-widget
1 compromised version
- Nov 14, 2022
Malicious code in webpack-dev-fixture (npm)
- Nov 14, 2022
Malicious code in webbluetooth-edison-demo (npm)
- Nov 14, 2022
Malicious code in stale-props (npm)
- Nov 14, 2022
Malicious code in react-nesting-example-legacy (npm)
- Nov 14, 2022
Malware in react-nesting-example-legacy
1 compromised version
- Nov 14, 2022
Malware in webpack-dev-fixture
1 compromised version
- Nov 14, 2022
Malware in webbluetooth-edison-demo
1 compromised version
- Nov 14, 2022
Malware in stale-props
1 compromised version
- Nov 10, 2022
Malicious code in @dbk-legacy/roster-modules-ebanking (npm)
- Nov 10, 2022
Malicious code in @dbk-legacy/muster (npm)
- Nov 10, 2022
Malware in @dbk-legacy/muster
1 compromised version
Page 6351 of 6,645