Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malicious code in @boosted-bounty/cassandra-helpers (npm)
- Jun 20, 2022
Malware in yelp_styleguide
1 compromised version
- Jun 20, 2022
Malware in @boosted-bounty/firebase-queue
1 compromised version
- Jun 20, 2022
Malware in @boosted-bounty/cassandra-helpers
1 compromised version
- Jun 20, 2022
Malware in yelp_js_alert
1 compromised version
- Jun 20, 2022
Malicious code in yelp_map_engine (npm)
- Jun 20, 2022
Malicious code in yelp_js_component (npm)
- Jun 20, 2022
Malicious code in koop-componentenbibliotheek (npm)
- Jun 20, 2022
Malicious code in kaartprikmodule (npm)
- Jun 20, 2022
Malware in yelp_js_component
1 compromised version
- Jun 20, 2022
Malware in kaartprikmodule
1 compromised version
- Jun 20, 2022
Malware in yelp_map_engine
1 compromised version
- Jun 20, 2022
Malware in koop-componentenbibliotheek
1 compromised version
- Jun 20, 2022
Malicious code in this-is-a-special-123 (npm)
- Jun 20, 2022
Malicious code in proton-super-package (npm)
- Jun 20, 2022
Malicious code in mynewpkgtest1 (npm)
- Jun 20, 2022
Malicious code in mynewpkgtest (npm)
- Jun 20, 2022
Malicious code in hs-inflamable-too (npm)
- Jun 20, 2022
Malware in hs-inflamable-too
1 compromised version
- Jun 20, 2022
Malware in proton-super-package
1 compromised version
- Jun 20, 2022
Malware in mynewpkgtest1
1 compromised version
- Jun 20, 2022
Malware in this-is-a-special-123
1 compromised version
- Jun 20, 2022
Malware in mynewpkgtest
1 compromised version
- Jun 20, 2022
Malicious code in mynewpkgtest4 (npm)
- Jun 20, 2022
Malicious code in mynewpkgtest3 (npm)
- Jun 20, 2022
Malicious code in mynewpkgtest2 (npm)
- Jun 20, 2022
Malware in mynewpkgtest4
1 compromised version
- Jun 20, 2022
Malware in mynewpkgtest2
1 compromised version
- Jun 20, 2022
Malware in mynewpkgtest3
1 compromised version
- Jun 20, 2022
Malicious code in mynewpkgtest6 (npm)
- Jun 20, 2022
Malicious code in mynewpkgtest5 (npm)
- Jun 20, 2022
Malicious code in hope-center (npm)
- Jun 20, 2022
Malicious code in hope-base (npm)
- Jun 20, 2022
Malicious code in eslint-plugin-jsdom-internal (npm)
- Jun 20, 2022
Malware in hope-base
1 compromised version
- Jun 20, 2022
Malware in mynewpkgtest5
1 compromised version
- Jun 20, 2022
Malware in hope-center
1 compromised version
- Jun 20, 2022
Malware in eslint-plugin-jsdom-internal
1 compromised version
- Jun 20, 2022
Malware in mynewpkgtest6
1 compromised version
- Jun 20, 2022
Malicious code in hope-hub (npm)
- Jun 20, 2022
Malicious code in hope-http-broker (npm)
- Jun 20, 2022
Malicious code in hope-entity-store (npm)
- Jun 20, 2022
Malicious code in hope-entity (npm)
- Jun 20, 2022
Malware in hope-hub
1 compromised version
- Jun 20, 2022
Malware in hope-entity-store
1 compromised version
- Jun 20, 2022
Malware in hope-http-broker
1 compromised version
- Jun 20, 2022
Malware in hope-entity
1 compromised version
- Jun 20, 2022
Malicious code in hope-workflow (npm)
- Jun 20, 2022
Malicious code in hope-store (npm)
- Jun 20, 2022
Malicious code in hope-session-manager (npm)
Page 6446 of 6,634