Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 19, 2022
Malware in http4s-proxy-aget
1 compromised version
- Aug 19, 2022
Malware in hytm-loader
1 compromised version
- Aug 19, 2022
Malware in gulp-elsint
1 compromised version
- Aug 19, 2022
Malware in infoectin
1 compromised version
- Aug 19, 2022
Malware in gogl7eapiqs
1 compromised version
- Aug 19, 2022
Malware in formidblue
1 compromised version
- Aug 19, 2022
Malware in genericnool
1 compromised version
- Aug 19, 2022
Malware in grunt-contrib-ugliyf
1 compromised version
- Aug 19, 2022
Malware in gulp--topreftixer
1 compromised version
- Aug 19, 2022
Malware in honsoliodate
1 compromised version
- Aug 19, 2022
Malware in inipyrser
1 compromised version
- Aug 19, 2022
Malware in gup-conca
1 compromised version
- Aug 19, 2022
Malware in grappq2
1 compromised version
- Aug 19, 2022
Malware in gular
1 compromised version
- Aug 19, 2022
Malware in invairant
1 compromised version
- Aug 19, 2022
Malware in handleqazs
1 compromised version
- Aug 19, 2022
Malware in immutability-huelperr
1 compromised version
- Aug 19, 2022
Malware in gtarc-fs
1 compromised version
- Aug 19, 2022
Malware in gcojb
1 compromised version
- Aug 19, 2022
Malware in grunt-contrib5-cop
1 compromised version
- Aug 19, 2022
Malware in gulpclan-css
1 compromised version
- Aug 19, 2022
Malware in fri9d-up
1 compromised version
- Aug 19, 2022
Malware in grayq-mater
1 compromised version
- Aug 19, 2022
Malware in font-awesomwu
1 compromised version
- Aug 19, 2022
Malware in -gzip-ize
1 compromised version
- Aug 19, 2022
Malware in http-proxy-iddlemare
1 compromised version
- Aug 19, 2022
Malware in hthb-entites
1 compromised version
- Aug 19, 2022
Malware in -harseurl
1 compromised version
- Aug 19, 2022
Malware in gulp-lpoada-plugins
1 compromised version
- Aug 19, 2022
Malware in highligjt.sj
1 compromised version
- Aug 19, 2022
Malware in fork-ts-checker-webpack-lugin-alt
1 compromised version
- Aug 19, 2022
Malware in iedux
1 compromised version
- Aug 19, 2022
Malware in get-ior
1 compromised version
- Aug 19, 2022
Malicious code in -d3-ushape (npm)
- Aug 19, 2022
Malicious code in figusr (npm)
- Aug 19, 2022
Malicious code in fiet (npm)
- Aug 19, 2022
Malicious code in fhlljs (npm)
- Aug 19, 2022
Malicious code in fdig (npm)
- Aug 19, 2022
Malicious code in fasclck (npm)
- Aug 19, 2022
Malicious code in f1pen (npm)
- Aug 19, 2022
Malicious code in ewenl2mitter2 (npm)
- Aug 19, 2022
Malicious code in esyncvalidator (npm)
- Aug 19, 2022
Malicious code in eslsh (npm)
- Aug 19, 2022
Malicious code in eslintr-plugzn-promise (npm)
- Aug 19, 2022
Malicious code in eslint-plwgin-stdnard (npm)
- Aug 19, 2022
Malicious code in eslint-plugincxst (npm)
- Aug 19, 2022
Malicious code in eslint-plugin-reatc (npm)
- Aug 19, 2022
Malicious code in eslint-plguin-babel (npm)
- Aug 19, 2022
Malicious code in eslint-conig-prezier (npm)
- Aug 19, 2022
Malicious code in eslinft-pluuin-import (npm)
Page 6368 of 6,634