Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malicious code in hope-message (npm)
- Jun 20, 2022
Malicious code in hope-hub-center-shared (npm)
- Jun 20, 2022
Malware in hope-session-manager
1 compromised version
- Jun 20, 2022
Malware in hope-store
1 compromised version
- Jun 20, 2022
Malware in hope-message
1 compromised version
- Jun 20, 2022
Malware in hope-hub-center-shared
1 compromised version
- Jun 20, 2022
Malware in hope-workflow
1 compromised version
- Jun 20, 2022
Malicious code in wtfpkgtst (npm)
- Jun 20, 2022
Malicious code in nowaypkg (npm)
- Jun 20, 2022
Malicious code in 01template1 (npm)
- Jun 20, 2022
Malware in 01template1
1 compromised version
- Jun 20, 2022
Malware in nowaypkg
1 compromised version
- Jun 20, 2022
Malware in wtfpkgtst
1 compromised version
- Jun 20, 2022
Malicious code in jose-cookbook (npm)
- Jun 20, 2022
Malicious code in hubs-configtool (npm)
- Jun 20, 2022
Malicious code in fxa-dev-launcher (npm)
- Jun 20, 2022
Malicious code in devtools-wasm-dwarf (npm)
- Jun 20, 2022
Malware in devtools-wasm-dwarf
1 compromised version
- Jun 20, 2022
Malware in fxa-dev-launcher
1 compromised version
- Jun 20, 2022
Malware in hubs-configtool
1 compromised version
- Jun 20, 2022
Malware in jose-cookbook
1 compromised version
- Jun 20, 2022
Malicious code in webext-experiment-utils (npm)
- Jun 20, 2022
Malicious code in wdcustom-breakpoint (npm)
- Jun 20, 2022
Malicious code in rnpm-plugin-test (npm)
- Jun 20, 2022
Malicious code in base-app-unauth (npm)
- Jun 20, 2022
Malicious code in api-unauthed (npm)
- Jun 20, 2022
Malware in wdcustom-breakpoint
1 compromised version
- Jun 20, 2022
Malware in webext-experiment-utils
1 compromised version
- Jun 20, 2022
Malware in base-app-unauth
1 compromised version
- Jun 20, 2022
Malware in rnpm-plugin-test
1 compromised version
- Jun 20, 2022
Malware in api-unauthed
1 compromised version
- Jun 20, 2022
Malicious code in wf-translate-text (npm)
- Jun 20, 2022
Malicious code in smithy-typescript (npm)
- Jun 20, 2022
Malicious code in gs-ux-uitoolkit (npm)
- Jun 20, 2022
Malware in gs-ux-uitoolkit
1 compromised version
- Jun 20, 2022
Malware in smithy-typescript
1 compromised version
- Jun 20, 2022
Malware in wf-translate-text
1 compromised version
- Jun 20, 2022
Malicious code in amazon-s3-find-and-forget (npm)
- Jun 20, 2022
Malicious code in amazon-kinesis-video-streams-webrtc-sdk-js (npm)
- Jun 20, 2022
Malicious code in service-workbench-on-aws (npm)
- Jun 20, 2022
Malicious code in aws-solutions-constructs (npm)
- Jun 20, 2022
Malicious code in aws-data-api-ux (npm)
- Jun 20, 2022
Malware in aws-solutions-constructs
1 compromised version
- Jun 20, 2022
Malware in amazon-s3-find-and-forget
1 compromised version
- Jun 20, 2022
Malware in amazon-kinesis-video-streams-webrtc-sdk-js
1 compromised version
- Jun 20, 2022
Malware in service-workbench-on-aws
1 compromised version
- Jun 20, 2022
Malware in aws-data-api-ux
1 compromised version
- Jun 20, 2022
Malicious code in unicornflix (npm)
- Jun 20, 2022
Malicious code in aws-delivlib-sample (npm)
- Jun 20, 2022
Malicious code in aws-amplify-unicorntrivia-workshop (npm)
Page 6447 of 6,634