Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malicious code in textlint-checker-for-vuejs-jp-docs (npm)
- Jun 20, 2022
Malicious code in service-module-utils (npm)
- Jun 20, 2022
Malicious code in service-module-api (npm)
- Jun 20, 2022
Malware in textlint-checker-for-vuejs-jp-docs
1 compromised version
- Jun 20, 2022
Malware in service-module-api
1 compromised version
- Jun 20, 2022
Malware in vue-loader-v15
1 compromised version
- Jun 20, 2022
Malware in service-module-utils
1 compromised version
- Jun 20, 2022
Malicious code in @snapp/ui-kit (npm)
- Jun 20, 2022
Malicious code in @snapp/framework (npm)
- Jun 20, 2022
Malicious code in @nothingfu/test (npm)
- Jun 20, 2022
Malicious code in johncenatesting (npm)
- Jun 20, 2022
Malware in @snapp/ui-kit
1 compromised version
- Jun 20, 2022
Malware in johncenatesting
1 compromised version
- Jun 20, 2022
Malware in @nothingfu/test
1 compromised version
- Jun 20, 2022
Malware in @snapp/framework
1 compromised version
- Jun 20, 2022
Malicious code in jensectesting (npm)
- Jun 20, 2022
Malicious code in fk-ua-parser (npm)
- Jun 20, 2022
Malicious code in evil-package-sample (npm)
- Jun 20, 2022
Malicious code in asana-actions (npm)
- Jun 20, 2022
Malware in asana-actions
1 compromised version
- Jun 20, 2022
Malware in evil-package-sample
1 compromised version
- Jun 20, 2022
Malware in jensectesting
1 compromised version
- Jun 20, 2022
Malware in fk-ua-parser
1 compromised version
- Jun 20, 2022
Malicious code in zd-svg-icons (npm)
- Jun 20, 2022
Malicious code in wp-calypso (npm)
- Jun 20, 2022
Malicious code in ng-json-explorer (npm)
- Jun 20, 2022
Malicious code in jetpack-eslint (npm)
- Jun 20, 2022
Malicious code in isolated-block-editor (npm)
- Jun 20, 2022
Malware in wp-calypso
1 compromised version
- Jun 20, 2022
Malware in zd-svg-icons
1 compromised version
- Jun 20, 2022
Malware in isolated-block-editor
1 compromised version
- Jun 20, 2022
Malware in ng-json-explorer
1 compromised version
- Jun 20, 2022
Malware in jetpack-eslint
1 compromised version
- Jun 20, 2022
Malicious code in adaptivecards-extras-designer (npm)
- Jun 20, 2022
Malicious code in chat-component-bindings (npm)
- Jun 20, 2022
Malicious code in calling-stateful-client (npm)
- Jun 20, 2022
Malware in calling-stateful-client
1 compromised version
- Jun 20, 2022
Malware in chat-component-bindings
1 compromised version
- Jun 20, 2022
Malware in adaptivecards-extras-designer
1 compromised version
- Jun 20, 2022
Malicious code in acs-ui-common (npm)
- Jun 20, 2022
Malicious code in @highspot/closure-loader (npm)
- Jun 20, 2022
Malicious code in com.unity.scriptablebuildpipeline (npm)
- Jun 20, 2022
Malicious code in angular-codemirror (npm)
- Jun 20, 2022
Malware in angular-codemirror
1 compromised version
- Jun 20, 2022
Malware in acs-ui-common
1 compromised version
- Jun 20, 2022
Malware in @highspot/closure-loader
1 compromised version
- Jun 20, 2022
Malware in com.unity.scriptablebuildpipeline
1 compromised version
- Jun 20, 2022
Malicious code in amplify_default (npm)
- Jun 20, 2022
Malicious code in @ws-amplify/core (npm)
- Jun 20, 2022
Malicious code in xrprovider (npm)
Page 6452 of 6,634