Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malicious code in github-brand (npm)
- Jun 20, 2022
Malicious code in ford-cpo-v3-packaging (npm)
- Jun 20, 2022
Malicious code in energy-phoenix-core-auth (npm)
- Jun 20, 2022
Malicious code in ayalon-demo-website-frontend (npm)
- Jun 20, 2022
Malware in publicrepoui
1 compromised version
- Jun 20, 2022
Malware in ayalon-demo-website-frontend
1 compromised version
- Jun 20, 2022
Malware in github-brand
1 compromised version
- Jun 20, 2022
Malware in energy-phoenix-core-auth
1 compromised version
- Jun 20, 2022
Malware in ford-cpo-v3-packaging
1 compromised version
- Jun 20, 2022
Malicious code in microsites-ui-hudsons-bay-french (npm)
- Jun 20, 2022
Malicious code in customer-stories-feed (npm)
- Jun 20, 2022
Malicious code in click-out-report-website (npm)
- Jun 20, 2022
Malware in microsites-ui-hudsons-bay-french
1 compromised version
- Jun 20, 2022
Malware in click-out-report-website
1 compromised version
- Jun 20, 2022
Malware in customer-stories-feed
1 compromised version
- Jun 20, 2022
Malicious code in trip-tracker-web (npm)
- Jun 20, 2022
Malicious code in training-kit (npm)
- Jun 20, 2022
Malicious code in oro-gulp (npm)
- Jun 20, 2022
Malicious code in health-bot-onboarding-client (npm)
- Jun 20, 2022
Malicious code in giphy-web-app (npm)
- Jun 20, 2022
Malware in health-bot-onboarding-client
1 compromised version
- Jun 20, 2022
Malware in trip-tracker-web
1 compromised version
- Jun 20, 2022
Malware in giphy-web-app
1 compromised version
- Jun 20, 2022
Malware in training-kit
1 compromised version
- Jun 20, 2022
Malware in oro-gulp
1 compromised version
- Jun 20, 2022
Malicious code in @koop-components/common (npm)
- Jun 20, 2022
Malicious code in fluxible-repo (npm)
- Jun 20, 2022
Malicious code in fetchr-simple-example (npm)
- Jun 20, 2022
Malicious code in badge-up-api (npm)
- Jun 20, 2022
Malware in @koop-components/common
1 compromised version
- Jun 20, 2022
Malware in fluxible-repo
1 compromised version
- Jun 20, 2022
Malware in fetchr-simple-example
1 compromised version
- Jun 20, 2022
Malware in badge-up-api
1 compromised version
- Jun 20, 2022
Malicious code in grab-login (npm)
- Jun 20, 2022
Malicious code in grab-locale (npm)
- Jun 20, 2022
Malicious code in evil-testing (npm)
- Jun 20, 2022
Malicious code in evil-test-1 (npm)
- Jun 20, 2022
Malware in grab-locale
1 compromised version
- Jun 20, 2022
Malware in evil-test-1
1 compromised version
- Jun 20, 2022
Malware in grab-login
1 compromised version
- Jun 20, 2022
Malware in evil-testing
1 compromised version
- Jun 20, 2022
Malicious code in @nerv-hq/control-system (npm)
- Jun 20, 2022
Malicious code in grab-ui (npm)
- Jun 20, 2022
Malicious code in grab-storage (npm)
- Jun 20, 2022
Malicious code in elide-doc (npm)
- Jun 20, 2022
Malware in grab-ui
1 compromised version
- Jun 20, 2022
Malware in grab-storage
1 compromised version
- Jun 20, 2022
Malware in @nerv-hq/control-system
1 compromised version
- Jun 20, 2022
Malware in elide-doc
1 compromised version
- Jun 20, 2022
Malicious code in rippled-exporter (npm)
Page 6444 of 6,634