Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malicious code in parity-exporter (npm)
- Jun 20, 2022
Malicious code in block-utxos (npm)
- Jun 20, 2022
Malware in block-utxos
1 compromised version
- Jun 20, 2022
Malware in parity-exporter
1 compromised version
- Jun 20, 2022
Malware in rippled-exporter
1 compromised version
- Jun 20, 2022
Malicious code in nim-status-client (npm)
- Jun 20, 2022
Malicious code in mattermost-webapp (npm)
- Jun 20, 2022
Malicious code in eslint-plugin-mattermost (npm)
- Jun 20, 2022
Malicious code in dynamic-virtualized-list (npm)
- Jun 20, 2022
Malware in nim-status-client
1 compromised version
- Jun 20, 2022
Malware in mattermost-webapp
1 compromised version
- Jun 20, 2022
Malware in dynamic-virtualized-list
1 compromised version
- Jun 20, 2022
Malware in eslint-plugin-mattermost
1 compromised version
- Jun 20, 2022
Malicious code in translationscripts (npm)
- Jun 20, 2022
Malicious code in paytm-mini-programs-nodejs-sdk (npm)
- Jun 20, 2022
Malicious code in paytm-blink-checkout-react-example (npm)
- Jun 20, 2022
Malicious code in matomo-analytics-cloudflare-app (npm)
- Jun 20, 2022
Malicious code in github-issue-mirror (npm)
- Jun 20, 2022
Malware in github-issue-mirror
1 compromised version
- Jun 20, 2022
Malware in paytm-blink-checkout-react-example
1 compromised version
- Jun 20, 2022
Malware in translationscripts
1 compromised version
- Jun 20, 2022
Malware in matomo-analytics-cloudflare-app
1 compromised version
- Jun 20, 2022
Malware in paytm-mini-programs-nodejs-sdk
1 compromised version
- Jun 20, 2022
Malicious code in twitter-new (npm)
- Jun 20, 2022
Malicious code in payments-reference-app (npm)
- Jun 20, 2022
Malicious code in cadence-docs (npm)
- Jun 20, 2022
Malicious code in blockswithscreens (npm)
- Jun 20, 2022
Malware in blockswithscreens
1 compromised version
- Jun 20, 2022
Malware in payments-reference-app
1 compromised version
- Jun 20, 2022
Malware in twitter-new
1 compromised version
- Jun 20, 2022
Malware in cadence-docs
1 compromised version
- Jun 20, 2022
Malicious code in webhint-configuration-braintree-sdk (npm)
- Jun 20, 2022
Malicious code in h3-website (npm)
- Jun 20, 2022
Malicious code in fbt-top-level-repo (npm)
- Jun 20, 2022
Malicious code in checkout-docs (npm)
- Jun 20, 2022
Malware in checkout-docs
1 compromised version
- Jun 20, 2022
Malware in h3-website
1 compromised version
- Jun 20, 2022
Malware in fbt-top-level-repo
1 compromised version
- Jun 20, 2022
Malware in webhint-configuration-braintree-sdk
1 compromised version
- Jun 20, 2022
Malicious code in @boosted-bounty/worker-helpers (npm)
- Jun 20, 2022
Malicious code in @boosted-bounty/firebase-helpers-js (npm)
- Jun 20, 2022
Malicious code in @boosted-bounty/firebase-helpers (npm)
- Jun 20, 2022
Malicious code in @boosted-bounty/backend-interfaces (npm)
- Jun 20, 2022
Malware in @boosted-bounty/worker-helpers
1 compromised version
- Jun 20, 2022
Malware in @boosted-bounty/firebase-helpers
1 compromised version
- Jun 20, 2022
Malware in @boosted-bounty/backend-interfaces
1 compromised version
- Jun 20, 2022
Malware in @boosted-bounty/firebase-helpers-js
1 compromised version
- Jun 20, 2022
Malicious code in yelp_styleguide (npm)
- Jun 20, 2022
Malicious code in yelp_js_alert (npm)
- Jun 20, 2022
Malicious code in @boosted-bounty/firebase-queue (npm)
Page 6445 of 6,634