Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jun 20, 2022
Malware in refocus-sample-generator-template-utils
1 compromised version
- Jun 20, 2022
Malware in acorn-visualforce
1 compromised version
- Jun 20, 2022
Malware in one-world-radio
1 compromised version
- Jun 20, 2022
Malicious code in toolbox-react-components (npm)
- Jun 20, 2022
Malicious code in ok2 (npm)
- Jun 20, 2022
Malicious code in my-carbon-app (npm)
- Jun 20, 2022
Malicious code in gorgias-api-docs (npm)
- Jun 20, 2022
Malware in toolbox-react-components
1 compromised version
- Jun 20, 2022
Malware in ok2
1 compromised version
- Jun 20, 2022
Malware in my-carbon-app
1 compromised version
- Jun 20, 2022
Malware in gorgias-api-docs
1 compromised version
- Jun 20, 2022
Malicious code in x3-stock-graphql-demo (npm)
- Jun 20, 2022
Malicious code in serverbeat (npm)
- Jun 20, 2022
Malicious code in sageone_api_ruby_sample (npm)
- Jun 20, 2022
Malicious code in f-amnotacat (npm)
- Jun 20, 2022
Malware in sageone_api_ruby_sample
1 compromised version
- Jun 20, 2022
Malware in x3-stock-graphql-demo
1 compromised version
- Jun 20, 2022
Malware in f-amnotacat
1 compromised version
- Jun 20, 2022
Malware in serverbeat
1 compromised version
- Jun 20, 2022
Malicious code in turing-ui (npm)
- Jun 20, 2022
Malicious code in sdm.vendor.lds (npm)
- Jun 20, 2022
Malicious code in merlin-ui (npm)
- Jun 20, 2022
Malicious code in loblawsdigitalflyer (npm)
- Jun 20, 2022
Malicious code in fckez.fckez (npm)
- Jun 20, 2022
Malware in merlin-ui
1 compromised version
- Jun 20, 2022
Malware in loblawsdigitalflyer
1 compromised version
- Jun 20, 2022
Malware in fckez.fckez
1 compromised version
- Jun 20, 2022
Malware in sdm.vendor.lds
1 compromised version
- Jun 20, 2022
Malware in turing-ui
1 compromised version
- Jun 20, 2022
Malicious code in nf-data-explorer-2 (npm)
- Jun 20, 2022
Malicious code in nextjs-accelerator (npm)
- Jun 20, 2022
Malicious code in auth0-react-03-calling-an-api (npm)
- Jun 20, 2022
Malware in nf-data-explorer-2
1 compromised version
- Jun 20, 2022
Malware in nextjs-accelerator
1 compromised version
- Jun 20, 2022
Malware in auth0-react-03-calling-an-api
1 compromised version
- Jun 20, 2022
Malicious code in nodejs-docs-samples-iot-mqtt-example (npm)
- Jun 20, 2022
Malicious code in nestjs-proxy (npm)
- Jun 20, 2022
Malicious code in loblaws-product-listing (npm)
- Jun 20, 2022
Malicious code in ffdc-corporate-banking-sample (npm)
- Jun 20, 2022
Malicious code in ffdc-api-security (npm)
- Jun 20, 2022
Malicious code in donate-backend (npm)
- Jun 20, 2022
Malware in ffdc-api-security
1 compromised version
- Jun 20, 2022
Malware in nestjs-proxy
1 compromised version
- Jun 20, 2022
Malware in ffdc-corporate-banking-sample
1 compromised version
- Jun 20, 2022
Malware in nodejs-docs-samples-iot-mqtt-example
1 compromised version
- Jun 20, 2022
Malware in donate-backend
1 compromised version
- Jun 20, 2022
Malware in loblaws-product-listing
1 compromised version
- Jun 20, 2022
Malicious code in finastra.design (npm)
- Jun 20, 2022
Malicious code in finastra (npm)
- Jun 20, 2022
Malicious code in fds-test (npm)
Page 6432 of 6,634