Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 18, 2022
Malware in obyte-witness
1 compromised version
- Jul 18, 2022
Malware in kadenaswap-ui
1 compromised version
- Jul 18, 2022
Malware in alertmanager-discord
1 compromised version
- Jul 18, 2022
Malware in cartesi-subgraph
1 compromised version
- Jul 18, 2022
Malware in lido-cosmos-docs
1 compromised version
- Jul 18, 2022
Malware in morpho-token
1 compromised version
- Jul 18, 2022
Malware in sushiswap-analytics
1 compromised version
- Jul 18, 2022
Malware in anyswap-rewards
1 compromised version
- Jul 18, 2022
Malware in ptokens-erc777-smart-contract
1 compromised version
- Jul 18, 2022
Malware in anytoken-locked
1 compromised version
- Jul 18, 2022
Malware in sgn-explorer
1 compromised version
- Jul 18, 2022
Malware in headless-obyte
1 compromised version
- Jul 18, 2022
Malware in tranchess-core
1 compromised version
- Jul 18, 2022
Malware in axelar-signing-relayer
1 compromised version
- Jul 18, 2022
Malware in ib-subgraph
1 compromised version
- Jul 18, 2022
Malicious code in @gettilled/tslint-preset (npm)
- Jul 18, 2022
Malicious code in @gettilled/commitlint-preset (npm)
- Jul 18, 2022
Malware in @gettilled/commitlint-preset
1 compromised version
- Jul 18, 2022
Malware in @gettilled/tslint-preset
1 compromised version
- Jul 18, 2022
Malicious code in ks-log (npm)
- Jul 18, 2022
Malware in ks-log
1 compromised version
- Jul 18, 2022
Malicious code in discord.js-selfbot-v15 (npm)
- Jul 18, 2022
Malicious code in discord.js-request (npm)
- Jul 18, 2022
Malware in discord.js-request
1 compromised version
- Jul 18, 2022
Malware in discord.js-selfbot-v15
1 compromised version
- Jul 14, 2022
Malicious code in discord.js-11 (npm)
3 compromised versions
- Jul 14, 2022
Malicious code in api-discord.js (npm)
- Jul 14, 2022
Malware in api-discord.js
1 compromised version
- Jul 14, 2022
Malware in discord.js-11
1 compromised version
- Jul 14, 2022
Malicious code in capitain-title (npm)
- Jul 14, 2022
Malware in capitain-title
1 compromised version
- Jul 14, 2022
Malicious code in discord.js-selfbot-v12 (npm)
2 compromised versions
- Jul 14, 2022
Malware in discord.js-selfbot-v12
1 compromised version
- Jul 12, 2022
Malicious code in ajax-libary (npm)
1 compromised version
- Jul 12, 2022
Malicious code in libz.jquery (npm)
4 compromised versions
- Jul 12, 2022
Malicious code in atezzz (npm)
3 compromised versions
- Jul 12, 2022
Malware in ajax-libary
1 compromised version
- Jul 12, 2022
Malware in atezzz
1 compromised version
- Jul 12, 2022
Malware in libz.jquery
1 compromised version
- Jul 12, 2022
Malicious code in ajaxapis (npm)
1 compromised version
- Jul 12, 2022
Malicious code in tescodek (npm)
1 compromised version
- Jul 12, 2022
Malware in tescodek
1 compromised version
- Jul 12, 2022
Malware in ajaxapis
1 compromised version
- Jul 12, 2022
Malicious code in restli-utils (npm)
- Jul 12, 2022
Malicious code in gfg-gpe-utilities (npm)
- Jul 12, 2022
Malware in restli-utils
1 compromised version
- Jul 12, 2022
Malware in gfg-gpe-utilities
1 compromised version
- Jul 12, 2022
Malicious code in waffles-icons (npm)
- Jul 12, 2022
Malware in waffles-icons
1 compromised version
- Jul 12, 2022
Malicious code in @roborox_int/elk-logger (npm)
Page 6407 of 6,634