Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 25, 2022
Malware in wm-dagre
1 compromised version
- Jul 25, 2022
Malicious code in yodaspeak-cloudflare-workers (npm)
- Jul 25, 2022
Malicious code in wm-ngx-graph (npm)
- Jul 25, 2022
Malware in yodaspeak-cloudflare-workers
1 compromised version
- Jul 25, 2022
Malware in wm-ngx-graph
1 compromised version
- Jul 25, 2022
Malicious code in jworkflow (npm)
- Jul 25, 2022
Malicious code in defi-interfaces (npm)
- Jul 25, 2022
Malware in jworkflow
1 compromised version
- Jul 25, 2022
Malware in defi-interfaces
1 compromised version
- Jul 25, 2022
Malicious code in support-center-components (npm)
- Jul 25, 2022
Malware in support-center-components
1 compromised version
- Jul 25, 2022
Malicious code in twilio-bugcrowd-poc-twilio-flex-ui-sample (npm)
- Jul 25, 2022
Malicious code in stripe-demo-connect-standard-saas-platform (npm)
- Jul 25, 2022
Malicious code in starlink2 (npm)
- Jul 25, 2022
Malicious code in pod-publishing-test (npm)
- Jul 25, 2022
Malicious code in owncloud-guests (npm)
- Jul 25, 2022
Malicious code in lido-dao-test-dp (npm)
- Jul 25, 2022
Malicious code in jet-anchor-test (npm)
- Jul 25, 2022
Malicious code in hft-frontend-test (npm)
- Jul 25, 2022
Malicious code in ethereum-freeton-bridge-contracts-test (npm)
- Jul 25, 2022
Malicious code in elementor-developers-docs (npm)
- Jul 25, 2022
Malicious code in defisaver-v3-contracts-test (npm)
- Jul 25, 2022
Malicious code in astar-portal-test-depconf (npm)
- Jul 25, 2022
Malware in stripe-demo-connect-standard-saas-platform
1 compromised version
- Jul 25, 2022
Malware in starlink2
1 compromised version
- Jul 25, 2022
Malware in lido-dao-test-dp
1 compromised version
- Jul 25, 2022
Malware in hft-frontend-test
1 compromised version
- Jul 25, 2022
Malware in pod-publishing-test
1 compromised version
- Jul 25, 2022
Malware in defisaver-v3-contracts-test
1 compromised version
- Jul 25, 2022
Malware in jet-anchor-test
1 compromised version
- Jul 25, 2022
Malware in ethereum-freeton-bridge-contracts-test
1 compromised version
- Jul 25, 2022
Malware in twilio-bugcrowd-poc-twilio-flex-ui-sample
1 compromised version
- Jul 25, 2022
Malware in elementor-developers-docs
1 compromised version
- Jul 25, 2022
Malware in owncloud-guests
1 compromised version
- Jul 25, 2022
Malware in astar-portal-test-depconf
1 compromised version
- Jul 22, 2022
Malicious code in mail-core-git (npm)
- Jul 22, 2022
Malware in mail-core-git
1 compromised version
- Jul 22, 2022
Malicious code in @ucs-private/rollup-plugin-dts-bundle (npm)
- Jul 22, 2022
Malware in @ucs-private/rollup-plugin-dts-bundle
1 compromised version
- Jul 22, 2022
Malicious code in @foodplex/ui (npm)
- Jul 22, 2022
Malware in @foodplex/ui
1 compromised version
- Jul 22, 2022
Malicious code in @biz-vue/utils (npm)
- Jul 22, 2022
Malware in @biz-vue/utils
1 compromised version
- Jul 22, 2022
Malicious code in @ucs-private/kiosk-core (npm)
- Jul 22, 2022
Malware in @ucs-private/kiosk-core
1 compromised version
- Jul 22, 2022
Malicious code in widget-framework (npm)
- Jul 22, 2022
Malware in widget-framework
1 compromised version
- Jul 22, 2022
Malicious code in ac-appleicons (npm)
- Jul 22, 2022
Malware in ac-appleicons
1 compromised version
- Jul 22, 2022
Malicious code in pidl-react (npm)
Page 6400 of 6,634