Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 21, 2022
Malicious code in search-gov-website (npm)
- Jul 21, 2022
Malicious code in phoenix.site (npm)
- Jul 21, 2022
Malicious code in identity-partners-site (npm)
- Jul 21, 2022
Malicious code in identity-dev-docs (npm)
- Jul 21, 2022
Malicious code in chargebyte (npm)
- Jul 21, 2022
Malware in sparhandy-speedtest
1 compromised version
- Jul 21, 2022
Malware in phoenix.site
1 compromised version
- Jul 21, 2022
Malware in analytics.usa.gov
1 compromised version
- Jul 21, 2022
Malware in search-gov-website
1 compromised version
- Jul 21, 2022
Malware in tss-marketing
1 compromised version
- Jul 21, 2022
Malware in identity-partners-site
1 compromised version
- Jul 21, 2022
Malware in identity-dev-docs
1 compromised version
- Jul 21, 2022
Malware in chargebyte
1 compromised version
- Jul 21, 2022
Malicious code in accent.jobs (npm)
- Jul 21, 2022
Malicious code in web-kore-sdk (npm)
- Jul 21, 2022
Malicious code in unibet_package (npm)
- Jul 21, 2022
Malicious code in ua-publication-manager (npm)
- Jul 21, 2022
Malicious code in style-guide-microsite (npm)
- Jul 21, 2022
Malicious code in starbuckssystem.website (npm)
- Jul 21, 2022
Malicious code in serverless-push-hasura (npm)
- Jul 21, 2022
Malicious code in sales-demo (npm)
- Jul 21, 2022
Malicious code in rsk-devportal (npm)
- Jul 21, 2022
Malicious code in rg-engineering (npm)
- Jul 21, 2022
Malicious code in promohline (npm)
- Jul 21, 2022
Malicious code in portail-web (npm)
- Jul 21, 2022
Malicious code in nozbedesktop (npm)
- Jul 21, 2022
Malicious code in mofronts (npm)
- Jul 21, 2022
Malicious code in ledger-live-assets (npm)
- Jul 21, 2022
Malicious code in kinesis-app-panel (npm)
- Jul 21, 2022
Malicious code in kenticodevelopmentconfiguration (npm)
- Jul 21, 2022
Malicious code in irisk (npm)
- Jul 21, 2022
Malicious code in identity-sam-landing (npm)
- Jul 21, 2022
Malicious code in hyatt-mumbai (npm)
- Jul 21, 2022
Malicious code in hemlibrademo1 (npm)
- Jul 21, 2022
Malicious code in fullcontact-wpengine (npm)
- Jul 21, 2022
Malicious code in forge-app-bones (npm)
- Jul 21, 2022
Malicious code in fitbit-connect (npm)
- Jul 21, 2022
Malicious code in ethics (npm)
- Jul 21, 2022
Malicious code in emarketing (npm)
- Jul 21, 2022
Malicious code in dpp_cms (npm)
- Jul 21, 2022
Malicious code in brandsites (npm)
- Jul 21, 2022
Malicious code in autotrain (npm)
- Jul 21, 2022
Malware in sales-demo
1 compromised version
- Jul 21, 2022
Malware in serverless-push-hasura
1 compromised version
- Jul 21, 2022
Malware in dpp_cms
1 compromised version
- Jul 21, 2022
Malware in rsk-devportal
1 compromised version
- Jul 21, 2022
Malware in ledger-live-assets
1 compromised version
- Jul 21, 2022
Malware in fullcontact-wpengine
1 compromised version
- Jul 21, 2022
Malware in accent.jobs
1 compromised version
- Jul 21, 2022
Malware in fitbit-connect
1 compromised version
Page 6403 of 6,634