Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,214 total in npm · sorted newest first- Oct 5, 2022
Malware in iconape
1 compromised version
- Oct 5, 2022
Malicious code in amitbhai (npm)
- Oct 5, 2022
Malicious code in win32ipc (npm)
- Oct 5, 2022
Malicious code in vinayakgadha (npm)
- Oct 5, 2022
Malicious code in taniyadidipro (npm)
- Oct 5, 2022
Malicious code in ktst (npm)
- Oct 5, 2022
Malicious code in helm-secrets-sops-driver (npm)
- Oct 5, 2022
Malicious code in helm-harness (npm)
- Oct 5, 2022
Malicious code in harness-helm-plugin (npm)
- Oct 5, 2022
Malicious code in graphql-ms (npm)
- Oct 5, 2022
Malicious code in example-jenkins (npm)
- Oct 5, 2022
Malicious code in example-gke-workload-identity-app (npm)
- Oct 5, 2022
Malicious code in evernote-sdk-sample-node (npm)
- Oct 5, 2022
Malicious code in dexclient (npm)
- Oct 5, 2022
Malicious code in dcrdata (npm)
- Oct 5, 2022
Malicious code in darshanno1 (npm)
- Oct 5, 2022
Malicious code in darshanbro (npm)
- Oct 5, 2022
Malware in taniyadidipro
1 compromised version
- Oct 5, 2022
Malware in dcrdata
1 compromised version
- Oct 5, 2022
Malware in example-jenkins
1 compromised version
- Oct 5, 2022
Malware in ktst
1 compromised version
- Oct 5, 2022
Malware in harness-helm-plugin
1 compromised version
- Oct 5, 2022
Malware in dexclient
1 compromised version
- Oct 5, 2022
Malware in evernote-sdk-sample-node
1 compromised version
- Oct 5, 2022
Malware in example-gke-workload-identity-app
1 compromised version
- Oct 5, 2022
Malware in darshanno1
1 compromised version
- Oct 5, 2022
Malware in graphql-ms
1 compromised version
- Oct 5, 2022
Malware in amitbhai
1 compromised version
- Oct 5, 2022
Malware in helm-harness
1 compromised version
- Oct 5, 2022
Malware in helm-secrets-sops-driver
1 compromised version
- Oct 5, 2022
Malware in darshanbro
1 compromised version
- Oct 5, 2022
Malware in vinayakgadha
1 compromised version
- Oct 5, 2022
Malware in win32ipc
1 compromised version
- Oct 5, 2022
Malicious code in discord-external (npm)
- Oct 5, 2022
Malware in discord-external
1 compromised version
- Oct 4, 2022
Malicious code in tds-publish (npm)
- Oct 4, 2022
Malware in tds-publish
1 compromised version
- Oct 4, 2022
Malicious code in ibiza-universe (npm)
- Oct 4, 2022
Malware in ibiza-universe
1 compromised version
- Oct 4, 2022
Malicious code in webcm-dev (npm)
- Oct 4, 2022
Malware in webcm-dev
1 compromised version
- Sep 29, 2022
Malicious code in dup-glob (npm)
- Sep 29, 2022
Malware in dup-glob
1 compromised version
- Sep 29, 2022
Malicious code in log-status (npm)
- Sep 29, 2022
Malware in log-status
1 compromised version
- Sep 29, 2022
Malicious code in iconbaru (npm)
- Sep 29, 2022
Malware in iconbaru
1 compromised version
- Sep 28, 2022
Malicious code in gramin-npm (npm)
- Sep 28, 2022
Malware in gramin-npm
1 compromised version
- Sep 28, 2022
Malicious code in @aszxc/npmexp (npm)
Page 6356 of 6,645