Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malware in ale_frugal
1 compromised version
- Jun 20, 2022
Malware in darkc0d3-test-xss
1 compromised version
- Jun 20, 2022
Malware in app_intelligence
1 compromised version
- Jun 20, 2022
Malicious code in admin_frugal (npm)
- Jun 20, 2022
Malicious code in workspaces_api (npm)
- Jun 20, 2022
Malicious code in wdesk_sdk (npm)
- Jun 20, 2022
Malicious code in wdesk_login (npm)
- Jun 20, 2022
Malicious code in wdesk-sdk-builders (npm)
- Jun 20, 2022
Malware in workspaces_api
1 compromised version
- Jun 20, 2022
Malware in wdesk_sdk
1 compromised version
- Jun 20, 2022
Malware in wdesk_login
1 compromised version
- Jun 20, 2022
Malware in wdesk-sdk-builders
1 compromised version
- Jun 20, 2022
Malware in admin_frugal
1 compromised version
- Jun 20, 2022
Malicious code in wdesk_browser_environment (npm)
- Jun 20, 2022
Malicious code in lucas_scocco_hacker (npm)
- Jun 20, 2022
Malicious code in intern_scocco_rce (npm)
- Jun 20, 2022
Malicious code in azure-function-core-tools (npm)
- Jun 20, 2022
Malware in lucas_scocco_hacker
1 compromised version
- Jun 20, 2022
Malware in azure-function-core-tools
1 compromised version
- Jun 20, 2022
Malware in wdesk_browser_environment
1 compromised version
- Jun 20, 2022
Malware in intern_scocco_rce
1 compromised version
- Jun 20, 2022
Malicious code in union-finance-contracts (npm)
- Jun 20, 2022
Malicious code in @cornershop/core (npm)
- Jun 20, 2022
Malicious code in bunny-v2 (npm)
- Jun 20, 2022
Malicious code in beefy-vote (npm)
- Jun 20, 2022
Malware in beefy-vote
1 compromised version
- Jun 20, 2022
Malware in @cornershop/core
1 compromised version
- Jun 20, 2022
Malware in union-finance-contracts
1 compromised version
- Jun 20, 2022
Malware in bunny-v2
1 compromised version
- Jun 20, 2022
Malicious code in @tinyspeck/calls-desktop-interop (npm)
- Jun 20, 2022
Malicious code in shub-service (npm)
- Jun 20, 2022
Malicious code in media-hid (npm)
- Jun 20, 2022
Malicious code in @dedatre/xptopkg (npm)
- Jun 20, 2022
Malware in @dedatre/xptopkg
1 compromised version
- Jun 20, 2022
Malware in media-hid
1 compromised version
- Jun 20, 2022
Malware in @tinyspeck/calls-desktop-interop
1 compromised version
- Jun 20, 2022
Malware in shub-service
1 compromised version
- Jun 20, 2022
Malicious code in telem (npm)
- Jun 20, 2022
Malicious code in teams-outlook-meeting-addin (npm)
- Jun 20, 2022
Malicious code in slimcore (npm)
- Jun 20, 2022
Malicious code in cm-integration (npm)
- Jun 20, 2022
Malware in telem
1 compromised version
- Jun 20, 2022
Malware in cm-integration
1 compromised version
- Jun 20, 2022
Malware in teams-outlook-meeting-addin
1 compromised version
- Jun 20, 2022
Malware in slimcore
1 compromised version
- Jun 20, 2022
Malicious code in redox-sample-nodejs (npm)
- Jun 20, 2022
Malicious code in ov-api (npm)
- Jun 20, 2022
Malicious code in exodus-update-server (npm)
- Jun 20, 2022
Malicious code in cryptolib-js (npm)
- Jun 20, 2022
Malware in cryptolib-js
1 compromised version
Page 6463 of 6,634