Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 19, 2022
Malware in xrunt-cl
1 compromised version
- Aug 19, 2022
Malware in wbpac-hot-middwleware
1 compromised version
- Aug 19, 2022
Malware in xgzgexp
1 compromised version
- Aug 19, 2022
Malware in veu-router
1 compromised version
- Aug 19, 2022
Malware in vikyl-buf2fer
1 compromised version
- Aug 19, 2022
Malware in userhme
1 compromised version
- Aug 19, 2022
Malware in vniyl-fs
1 compromised version
- Aug 19, 2022
Malware in ve-loaer
1 compromised version
- Aug 19, 2022
Malware in yeoman-enviromenv
1 compromised version
- Aug 19, 2022
Malware in vazliwd-url
1 compromised version
- Aug 19, 2022
Malware in wavchif
1 compromised version
- Aug 19, 2022
Malware in yargs-parxe
1 compromised version
- Aug 19, 2022
Malware in xml2jsno
1 compromised version
- Aug 19, 2022
Malware in webb3
1 compromised version
- Aug 19, 2022
Malware in yeoman-33enerator
1 compromised version
- Aug 19, 2022
Malware in xc4hrat.js
1 compromised version
- Aug 19, 2022
Malware in wexack-node-externals
1 compromised version
- Aug 19, 2022
Malicious code in uraib (npm)
- Aug 19, 2022
Malicious code in unzdrscore (npm)
- Aug 19, 2022
Malicious code in unist-utilu-4visit (npm)
- Aug 19, 2022
Malicious code in umreral (npm)
- Aug 19, 2022
Malicious code in ulp-watcgh (npm)
- Aug 19, 2022
Malicious code in ull-tream (npm)
- Aug 19, 2022
Malicious code in uglpti9f (npm)
- Aug 19, 2022
Malicious code in uglp-rename (npm)
- Aug 19, 2022
Malicious code in ug-lifjjs-webpack-plugin (npm)
- Aug 19, 2022
Malicious code in ttpd-erors (npm)
- Aug 19, 2022
Malicious code in tslnit (npm)
- Aug 19, 2022
Malicious code in tsli (npm)
- Aug 19, 2022
Malicious code in tsilnt (npm)
- Aug 19, 2022
Malicious code in ts--ptp (npm)
- Aug 19, 2022
Malicious code in trcer (npm)
- Aug 19, 2022
Malicious code in traecr (npm)
- Aug 19, 2022
Malicious code in tldyfy (npm)
- Aug 19, 2022
Malicious code in tld5ify (npm)
- Aug 19, 2022
Malicious code in tioredks (npm)
- Aug 19, 2022
Malicious code in tinhcyxolor2 (npm)
- Aug 19, 2022
Malicious code in timhutable (npm)
- Aug 19, 2022
Malicious code in thts (npm)
- Aug 19, 2022
Malicious code in thgroukgg (npm)
- Aug 19, 2022
Malicious code in text-ytabl (npm)
- Aug 19, 2022
Malicious code in terser-ebrpack-plugin (npm)
- Aug 19, 2022
Malicious code in tdype-si (npm)
- Aug 19, 2022
Malicious code in t4peork3m (npm)
- Aug 19, 2022
Malicious code in t-simp8e (npm)
- Aug 19, 2022
Malicious code in sysezjs (npm)
- Aug 19, 2022
Malicious code in synfc-wrequest (npm)
- Aug 19, 2022
Malicious code in swlenium-wkebdriver (npm)
- Aug 19, 2022
Malicious code in sw-prescache-wubpack-plugin (npm)
- Aug 19, 2022
Malicious code in supoertes (npm)
Page 6357 of 6,634