Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malicious code in @gs-ux-uitoolkit-react/select (npm)
- Jun 20, 2022
Malicious code in @gs-ux-uitoolkit-react/core (npm)
- Jun 20, 2022
Malicious code in epc-web-utils (npm)
- Jun 20, 2022
Malware in epc-web-utils
1 compromised version
- Jun 20, 2022
Malware in @gs-ux-uitoolkit-react/core
1 compromised version
- Jun 20, 2022
Malware in @umpirsky/country-list
1 compromised version
- Jun 20, 2022
Malware in @gs-ux-uitoolkit-react/select
1 compromised version
- Jun 20, 2022
Malicious code in golf-to-eid (npm)
- Jun 20, 2022
Malicious code in fe-grid (npm)
- Jun 20, 2022
Malicious code in dn-dev-env (npm)
- Jun 20, 2022
Malicious code in bls12377js (npm)
- Jun 20, 2022
Malware in bls12377js
1 compromised version
- Jun 20, 2022
Malware in dn-dev-env
1 compromised version
- Jun 20, 2022
Malware in fe-grid
1 compromised version
- Jun 20, 2022
Malware in golf-to-eid
1 compromised version
- Jun 20, 2022
Malicious code in sb-resp-ui (npm)
- Jun 20, 2022
Malicious code in sb-legacy-integration (npm)
- Jun 20, 2022
Malicious code in sb-helpers (npm)
- Jun 20, 2022
Malicious code in runkit-embed (npm)
- Jun 20, 2022
Malicious code in react-fe-bootstrap (npm)
- Jun 20, 2022
Malware in sb-legacy-integration
1 compromised version
- Jun 20, 2022
Malware in runkit-embed
1 compromised version
- Jun 20, 2022
Malware in react-fe-bootstrap
1 compromised version
- Jun 20, 2022
Malware in sb-helpers
1 compromised version
- Jun 20, 2022
Malware in sb-resp-ui
1 compromised version
- Jun 20, 2022
Malicious code in vstui (npm)
- Jun 20, 2022
Malicious code in tsmodulechecker (npm)
- Jun 20, 2022
Malicious code in syndication-templates (npm)
- Jun 20, 2022
Malicious code in sb-resp-utils (npm)
- Jun 20, 2022
Malware in sb-resp-utils
1 compromised version
- Jun 20, 2022
Malware in vstui
1 compromised version
- Jun 20, 2022
Malware in syndication-templates
1 compromised version
- Jun 20, 2022
Malware in tsmodulechecker
1 compromised version
- Jun 20, 2022
Malicious code in window-channel (npm)
- Jun 20, 2022
Malicious code in prism-reactjs (npm)
- Jun 20, 2022
Malicious code in inter-frontend-lib-header (npm)
- Jun 20, 2022
Malicious code in editor-kit (npm)
- Jun 20, 2022
Malware in inter-frontend-lib-header
1 compromised version
- Jun 20, 2022
Malware in window-channel
1 compromised version
- Jun 20, 2022
Malware in editor-kit
1 compromised version
- Jun 20, 2022
Malware in prism-reactjs
1 compromised version
- Jun 20, 2022
Malicious code in vue2-jest (npm)
- Jun 20, 2022
Malicious code in polaris-rails (npm)
- Jun 20, 2022
Malicious code in occl_core (npm)
- Jun 20, 2022
Malicious code in dexy (npm)
- Jun 20, 2022
Malware in polaris-rails
1 compromised version
- Jun 20, 2022
Malware in occl_core
1 compromised version
- Jun 20, 2022
Malware in vue2-jest
1 compromised version
- Jun 20, 2022
Malware in dexy
1 compromised version
- Jun 20, 2022
Malicious code in vue-loader-v15 (npm)
Page 6451 of 6,634