Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,214 total in npm · sorted newest first- Oct 24, 2022
Malware in maven-fluido-skin
1 compromised version
- Oct 24, 2022
Malicious code in anchor-lang (npm)
- Oct 24, 2022
Malicious code in test_1_61 (npm)
- Oct 24, 2022
Malicious code in test_1_60 (npm)
- Oct 24, 2022
Malicious code in test_1_59 (npm)
- Oct 24, 2022
Malicious code in test_1_58 (npm)
- Oct 24, 2022
Malicious code in test_1_57 (npm)
- Oct 24, 2022
Malicious code in spring-boot-devtools (npm)
- Oct 24, 2022
Malicious code in dapp2nix (npm)
- Oct 24, 2022
Malicious code in boost-for-react-native (npm)
- Oct 24, 2022
Malware in boost-for-react-native
1 compromised version
- Oct 24, 2022
Malware in test_1_58
1 compromised version
- Oct 24, 2022
Malware in anchor-lang
1 compromised version
- Oct 24, 2022
Malware in test_1_59
1 compromised version
- Oct 24, 2022
Malware in test_1_60
1 compromised version
- Oct 24, 2022
Malware in dapp2nix
1 compromised version
- Oct 24, 2022
Malware in test_1_61
1 compromised version
- Oct 24, 2022
Malware in test_1_57
1 compromised version
- Oct 24, 2022
Malware in spring-boot-devtools
1 compromised version
- Oct 24, 2022
Malicious code in surveyoptic (npm)
- Oct 24, 2022
Malware in surveyoptic
1 compromised version
- Oct 24, 2022
Malicious code in ui-ace (npm)
- Oct 24, 2022
Malware in ui-ace
1 compromised version
- Oct 24, 2022
Malicious code in aae-stream (npm)
- Oct 24, 2022
Malware in aae-stream
1 compromised version
- Oct 21, 2022
Malicious code in ty-cdn (npm)
- Oct 21, 2022
Malicious code in tazrim (npm)
- Oct 21, 2022
Malware in tazrim
1 compromised version
- Oct 21, 2022
Malware in ty-cdn
1 compromised version
- Oct 21, 2022
Malicious code in state-counter (npm)
- Oct 21, 2022
Malware in state-counter
1 compromised version
- Oct 20, 2022
Malicious code in not_lost (npm)
- Oct 20, 2022
Malware in not_lost
1 compromised version
- Oct 20, 2022
Malicious code in redirect-safe (npm)
- Oct 20, 2022
Malware in redirect-safe
1 compromised version
- Oct 20, 2022
Malicious code in discord-leveldb-dump (npm)
- Oct 20, 2022
Malware in discord-leveldb-dump
1 compromised version
- Oct 20, 2022
Malicious code in discord-thief (npm)
- Oct 20, 2022
Malware in discord-thief
1 compromised version
- Oct 20, 2022
Malicious code in react-redux-7 (npm)
- Oct 20, 2022
Malicious code in react-redux-4 (npm)
- Oct 20, 2022
Malware in react-redux-7
1 compromised version
- Oct 20, 2022
Malware in react-redux-4
1 compromised version
- Oct 19, 2022
Malicious code in @nexthink/waas (npm)
- Oct 19, 2022
Malicious code in @nexthink/remote-action-widgets (npm)
- Oct 19, 2022
Malicious code in @nexthink/nxnavigation (npm)
- Oct 19, 2022
Malicious code in @nexthink/nxassignment (npm)
- Oct 19, 2022
Malicious code in @nexthink/nql-editor (npm)
- Oct 19, 2022
Malicious code in @nexthink/kendo-react (npm)
- Oct 19, 2022
Malicious code in @nexthink/investigations-widgets (npm)
Page 6354 of 6,645