Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jun 22, 2022
Malware in omm-frontend
1 compromised version
- Jun 22, 2022
Malicious code in material-ui-plugin-theme-provider-cache (npm)
- Jun 21, 2022
Malicious code in @react-native-tscodegen/tslint-shared (npm)
- Jun 21, 2022
Malware in @react-native-tscodegen/tslint-shared
1 compromised version
- Jun 21, 2022
Malicious code in @atlas-angular/logger (npm)
- Jun 21, 2022
Malware in @atlas-angular/logger
1 compromised version
- Jun 21, 2022
Malicious code in mephisto-worker-experience (npm)
- Jun 21, 2022
Malware in mephisto-worker-experience
1 compromised version
- Jun 21, 2022
Malicious code in vngage-scheduler (npm)
- Jun 21, 2022
Malware in vngage-scheduler
1 compromised version
- Jun 21, 2022
Malicious code in cvent-web-components (npm)
- Jun 21, 2022
Malware in cvent-web-components
1 compromised version
- Jun 21, 2022
Malicious code in omm-frontend (npm)
- Jun 20, 2022
Malicious code in @sfcc-core/core (npm)
- Jun 20, 2022
Malicious code in @robinhoodcoop/contracts (npm)
- Jun 20, 2022
Malicious code in globo-ab-client (npm)
- Jun 20, 2022
Malware in @robinhoodcoop/contracts
1 compromised version
- Jun 20, 2022
Malware in globo-ab-client
1 compromised version
- Jun 20, 2022
Malware in @sfcc-core/core
1 compromised version
- Jun 20, 2022
Malicious code in taxjar-blog (npm)
- Jun 20, 2022
Malicious code in stitch-fix-women (npm)
- Jun 20, 2022
Malicious code in muzli-extension (npm)
- Jun 20, 2022
Malicious code in kiku-web (npm)
- Jun 20, 2022
Malicious code in default-static-site (npm)
- Jun 20, 2022
Malware in default-static-site
1 compromised version
- Jun 20, 2022
Malware in stitch-fix-women
1 compromised version
- Jun 20, 2022
Malware in taxjar-blog
1 compromised version
- Jun 20, 2022
Malware in kiku-web
1 compromised version
- Jun 20, 2022
Malware in muzli-extension
1 compromised version
- Jun 20, 2022
Malicious code in www.malwarebytes.com (npm)
- Jun 20, 2022
Malicious code in usaa-nw-build-tools (npm)
- Jun 20, 2022
Malicious code in development-guide (npm)
- Jun 20, 2022
Malicious code in cdw-portal-ui (npm)
- Jun 20, 2022
Malware in usaa-nw-build-tools
1 compromised version
- Jun 20, 2022
Malware in cdw-portal-ui
1 compromised version
- Jun 20, 2022
Malware in www.malwarebytes.com
1 compromised version
- Jun 20, 2022
Malware in development-guide
1 compromised version
- Jun 20, 2022
Malicious code in wm-plugins-core (npm)
- Jun 20, 2022
Malicious code in usaa-changelog (npm)
- Jun 20, 2022
Malicious code in public-portal-ui (npm)
- Jun 20, 2022
Malicious code in ent-screenshare (npm)
- Jun 20, 2022
Malware in usaa-changelog
1 compromised version
- Jun 20, 2022
Malware in public-portal-ui
1 compromised version
- Jun 20, 2022
Malware in ent-screenshare
1 compromised version
- Jun 20, 2022
Malware in wm-plugins-core
1 compromised version
- Jun 20, 2022
Malicious code in acorn-visualforce (npm)
- Jun 20, 2022
Malicious code in refocus-sample-generator-template-utils (npm)
- Jun 20, 2022
Malicious code in one-world-radio (npm)
- Jun 20, 2022
Malicious code in ember-malibu-icon (npm)
- Jun 20, 2022
Malware in ember-malibu-icon
1 compromised version
Page 6431 of 6,634