Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malware in ad1213
1 compromised version
- Jun 20, 2022
Malicious code in token-unit-es5 (npm)
- Jun 20, 2022
Malicious code in testnpmad12 (npm)
- Jun 20, 2022
Malicious code in testnpmad (npm)
- Jun 20, 2022
Malicious code in testad123 (npm)
- Jun 20, 2022
Malicious code in ng-browser-info (npm)
- Jun 20, 2022
Malware in testnpmad
1 compromised version
- Jun 20, 2022
Malware in testad123
1 compromised version
- Jun 20, 2022
Malware in testnpmad12
1 compromised version
- Jun 20, 2022
Malware in token-unit-es5
1 compromised version
- Jun 20, 2022
Malware in ng-browser-info
1 compromised version
- Jun 20, 2022
Malicious code in socless_integration_packager (npm)
- Jun 20, 2022
Malicious code in eslint-config-vmware-react (npm)
- Jun 20, 2022
Malicious code in bluejeans-api-rest-meetings (npm)
- Jun 20, 2022
Malware in bluejeans-api-rest-meetings
1 compromised version
- Jun 20, 2022
Malware in eslint-config-vmware-react
1 compromised version
- Jun 20, 2022
Malware in socless_integration_packager
1 compromised version
- Jun 20, 2022
Malicious code in unified-instantsearch-ecommerce (npm)
- Jun 20, 2022
Malicious code in prod-package (npm)
- Jun 20, 2022
Malicious code in persona-verifier-lib (npm)
- Jun 20, 2022
Malicious code in node-upwork-oauth2 (npm)
- Jun 20, 2022
Malicious code in eks-auto-create-idp (npm)
- Jun 20, 2022
Malware in node-upwork-oauth2
1 compromised version
- Jun 20, 2022
Malware in prod-package
1 compromised version
- Jun 20, 2022
Malware in eks-auto-create-idp
1 compromised version
- Jun 20, 2022
Malware in unified-instantsearch-ecommerce
1 compromised version
- Jun 20, 2022
Malware in persona-verifier-lib
1 compromised version
- Jun 20, 2022
Malicious code in shopify-utils (npm)
- Jun 20, 2022
Malicious code in shopify-tutorial (npm)
- Jun 20, 2022
Malicious code in shopify-proxy (npm)
- Jun 20, 2022
Malicious code in shopify-demo (npm)
- Jun 20, 2022
Malware in shopify-tutorial
1 compromised version
- Jun 20, 2022
Malware in shopify-utils
1 compromised version
- Jun 20, 2022
Malware in shopify-demo
1 compromised version
- Jun 20, 2022
Malware in shopify-proxy
1 compromised version
- Jun 20, 2022
Malicious code in shopify-ewrjknfd (npm)
- Jun 20, 2022
Malicious code in meta-left-pad (npm)
- Jun 20, 2022
Malicious code in @gco-angular/rxjs-utils (npm)
- Jun 20, 2022
Malicious code in @gco-angular/communication-facade (npm)
- Jun 20, 2022
Malware in meta-left-pad
1 compromised version
- Jun 20, 2022
Malware in @gco-angular/communication-facade
1 compromised version
- Jun 20, 2022
Malware in shopify-ewrjknfd
1 compromised version
- Jun 20, 2022
Malware in @gco-angular/rxjs-utils
1 compromised version
- Jun 20, 2022
Malicious code in @gs-ux-uitoolkit-react/theme (npm)
- Jun 20, 2022
Malicious code in @gs-ux-uitoolkit-react/shared (npm)
- Jun 20, 2022
Malicious code in @gco-angular/apollo (npm)
- Jun 20, 2022
Malware in @gs-ux-uitoolkit-react/theme
1 compromised version
- Jun 20, 2022
Malware in @gs-ux-uitoolkit-react/shared
1 compromised version
- Jun 20, 2022
Malware in @gco-angular/apollo
1 compromised version
- Jun 20, 2022
Malicious code in @umpirsky/country-list (npm)
Page 6450 of 6,634