Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malware in @tekion/gamma
1 compromised version
- Jun 20, 2022
Malicious code in trinity-pkg-ss (npm)
- Jun 20, 2022
Malicious code in shakt-pkg-ss (npm)
- Jun 20, 2022
Malicious code in puppetlabs-stdlib (npm)
- Jun 20, 2022
Malicious code in hacked-shakti (npm)
- Jun 20, 2022
Malware in puppetlabs-stdlib
1 compromised version
- Jun 20, 2022
Malware in shakt-pkg-ss
1 compromised version
- Jun 20, 2022
Malware in hacked-shakti
1 compromised version
- Jun 20, 2022
Malware in trinity-pkg-ss
1 compromised version
- Jun 20, 2022
Malicious code in internal_pk_for_ss (npm)
- Jun 20, 2022
Malicious code in 13-pkg-14 (npm)
- Jun 20, 2022
Malicious code in 13-pkg-1313 (npm)
- Jun 20, 2022
Malicious code in 13-pkg-13 (npm)
- Jun 20, 2022
Malware in 13-pkg-1313
1 compromised version
- Jun 20, 2022
Malware in 13-pkg-14
1 compromised version
- Jun 20, 2022
Malware in 13-pkg-13
1 compromised version
- Jun 20, 2022
Malware in internal_pk_for_ss
1 compromised version
- Jun 20, 2022
Malicious code in shakti_saan_sai755 (npm)
- Jun 20, 2022
Malicious code in sai_package_755 (npm)
- Jun 20, 2022
Malicious code in package_avvo_dep (npm)
- Jun 20, 2022
Malicious code in internal_pkg_for_755 (npm)
- Jun 20, 2022
Malware in sai_package_755
1 compromised version
- Jun 20, 2022
Malware in package_avvo_dep
1 compromised version
- Jun 20, 2022
Malware in shakti_saan_sai755
1 compromised version
- Jun 20, 2022
Malware in internal_pkg_for_755
1 compromised version
- Jun 20, 2022
Malicious code in @amp-metrics/mt-metricskit-deligates-html (npm)
- Jun 20, 2022
Malicious code in @amp-metrics/mt-metricskit (npm)
- Jun 20, 2022
Malicious code in package_test_avvo (npm)
- Jun 20, 2022
Malicious code in knsjdnksjdfn (npm)
- Jun 20, 2022
Malicious code in hakunamatata (npm)
- Jun 20, 2022
Malware in package_test_avvo
1 compromised version
- Jun 20, 2022
Malware in @amp-metrics/mt-metricskit
1 compromised version
- Jun 20, 2022
Malware in knsjdnksjdfn
1 compromised version
- Jun 20, 2022
Malware in @amp-metrics/mt-metricskit-deligates-html
1 compromised version
- Jun 20, 2022
Malware in hakunamatata
1 compromised version
- Jun 20, 2022
Malicious code in majortest (npm)
- Jun 20, 2022
Malicious code in hooolalulos (npm)
- Jun 20, 2022
Malicious code in cutoffurmind-ui-kit2 (npm)
- Jun 20, 2022
Malware in cutoffurmind-ui-kit2
1 compromised version
- Jun 20, 2022
Malware in majortest
1 compromised version
- Jun 20, 2022
Malware in hooolalulos
1 compromised version
- Jun 20, 2022
Malicious code in walmart-component-library (npm)
- Jun 20, 2022
Malicious code in telekom-index (npm)
- Jun 20, 2022
Malicious code in s-telekom (npm)
- Jun 20, 2022
Malicious code in cutoffurmind-ui-kit (npm)
- Jun 20, 2022
Malware in walmart-component-library
1 compromised version
- Jun 20, 2022
Malware in s-telekom
1 compromised version
- Jun 20, 2022
Malware in cutoffurmind-ui-kit
1 compromised version
- Jun 20, 2022
Malware in telekom-index
1 compromised version
- Jun 20, 2022
Malicious code in wmreact-spinner (npm)
Page 6461 of 6,634