Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 2, 2022
Malicious code in npm-dependency-submission-example (npm)
- Aug 2, 2022
Malicious code in maps-api-for-javascript (npm)
- Aug 2, 2022
Malicious code in f36-components (npm)
- Aug 2, 2022
Malicious code in dependency-submission-toolkit (npm)
- Aug 2, 2022
Malware in pm-manager
1 compromised version
- Aug 2, 2022
Malware in ai-image-tagging-lambda
1 compromised version
- Aug 2, 2022
Malware in f36-components
1 compromised version
- Aug 2, 2022
Malware in dependency-submission-toolkit
1 compromised version
- Aug 2, 2022
Malware in npm-dependency-submission-example
1 compromised version
- Aug 2, 2022
Malware in maps-api-for-javascript
1 compromised version
- Aug 2, 2022
Malware in zoho-app
1 compromised version
- Aug 2, 2022
Malicious code in anchor-website-common (npm)
- Aug 2, 2022
Malware in anchor-website-common
1 compromised version
- Aug 2, 2022
Malicious code in colorss (npm)
- Aug 2, 2022
Malicious code in colors-2.2.2 (npm)
- Aug 2, 2022
Malware in colors-2.2.2
1 compromised version
- Aug 2, 2022
Malware in colorss
1 compromised version
- Aug 2, 2022
Malicious code in swan-buyer (npm)
- Aug 2, 2022
Malicious code in panel-farm (npm)
- Aug 2, 2022
Malicious code in avax-js-cli-tools (npm)
- Aug 2, 2022
Malware in swan-buyer
1 compromised version
- Aug 2, 2022
Malware in avax-js-cli-tools
1 compromised version
- Aug 2, 2022
Malware in panel-farm
1 compromised version
- Aug 2, 2022
Malicious code in dolphin-database (npm)
- Aug 2, 2022
Malware in dolphin-database
1 compromised version
- Jul 29, 2022
Malicious code in protons-benchmark (npm)
- Jul 29, 2022
Malicious code in matchmaking-mgmt (npm)
- Jul 29, 2022
Malicious code in flipper-server-companion (npm)
- Jul 29, 2022
Malware in matchmaking-mgmt
1 compromised version
- Jul 29, 2022
Malware in flipper-server-companion
1 compromised version
- Jul 29, 2022
Malware in protons-benchmark
1 compromised version
- Jul 27, 2022
Malicious code in ishakti (npm)
- Jul 27, 2022
Malware in ishakti
1 compromised version
- Jul 27, 2022
Malicious code in epic-ue-loading (npm)
21 compromised versions
- Jul 27, 2022
Malware in epic-ue-loading
1 compromised version
- Jul 27, 2022
Malicious code in small-sm (npm)
- Jul 27, 2022
Malware in small-sm
1 compromised version
- Jul 27, 2022
Malicious code in dolphin-dbase (npm)
- Jul 27, 2022
Malicious code in db-dolphin (npm)
- Jul 27, 2022
Malicious code in database-dolphin (npm)
- Jul 27, 2022
Malware in database-dolphin
1 compromised version
- Jul 27, 2022
Malware in dolphin-dbase
1 compromised version
- Jul 27, 2022
Malware in db-dolphin
1 compromised version
- Jul 26, 2022
Malicious code in crashtravel-utilities (npm)
- Jul 26, 2022
Malware in crashtravel-utilities
1 compromised version
- Jul 26, 2022
Malicious code in lib-g (npm)
- Jul 26, 2022
Malware in lib-g
1 compromised version
- Jul 26, 2022
Malicious code in testdorime (npm)
- Jul 26, 2022
Malicious code in myfirstdependencywithserver (npm)
- Jul 26, 2022
Malicious code in floureeb (npm)
Page 6396 of 6,634