Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malware in ov-api
1 compromised version
- Jun 20, 2022
Malware in exodus-update-server
1 compromised version
- Jun 20, 2022
Malware in redox-sample-nodejs
1 compromised version
- Jun 20, 2022
Malicious code in zapper-safe-app (npm)
- Jun 20, 2022
Malicious code in rnwasmtest (npm)
- Jun 20, 2022
Malicious code in grpc-web-ruby (npm)
- Jun 20, 2022
Malicious code in audit-pricing (npm)
- Jun 20, 2022
Malware in zapper-safe-app
1 compromised version
- Jun 20, 2022
Malware in audit-pricing
1 compromised version
- Jun 20, 2022
Malware in rnwasmtest
1 compromised version
- Jun 20, 2022
Malware in grpc-web-ruby
1 compromised version
- Jun 20, 2022
Malicious code in zapper-api-stack (npm)
- Jun 20, 2022
Malicious code in sushiswap-shiny-frontend (npm)
- Jun 20, 2022
Malicious code in sovryn-node-integration-tests (npm)
- Jun 20, 2022
Malicious code in monday-integration-quickstart-app (npm)
- Jun 20, 2022
Malicious code in enzyme-kovan (npm)
- Jun 20, 2022
Malware in sushiswap-shiny-frontend
1 compromised version
- Jun 20, 2022
Malware in zapper-api-stack
1 compromised version
- Jun 20, 2022
Malware in enzyme-kovan
1 compromised version
- Jun 20, 2022
Malware in sovryn-node-integration-tests
1 compromised version
- Jun 20, 2022
Malware in monday-integration-quickstart-app
1 compromised version
- Jun 20, 2022
Malicious code in @aia-digital/request-module (npm)
- Jun 20, 2022
Malicious code in fei-protocol-core (npm)
- Jun 20, 2022
Malicious code in 2key-metrics (npm)
- Jun 20, 2022
Malicious code in apswap-api (npm)
- Jun 20, 2022
Malware in 2key-metrics
1 compromised version
- Jun 20, 2022
Malware in fei-protocol-core
1 compromised version
- Jun 20, 2022
Malware in @aia-digital/request-module
1 compromised version
- Jun 20, 2022
Malware in apswap-api
1 compromised version
- Jun 20, 2022
Malicious code in @worki/lib-web-common (npm)
- Jun 20, 2022
Malicious code in @aia-digital/ui-library (npm)
- Jun 20, 2022
Malicious code in js_packages_security_test (npm)
- Jun 20, 2022
Malicious code in @corporate/core (npm)
- Jun 20, 2022
Malware in @corporate/core
1 compromised version
- Jun 20, 2022
Malware in @aia-digital/ui-library
1 compromised version
- Jun 20, 2022
Malware in @worki/lib-web-common
1 compromised version
- Jun 20, 2022
Malware in js_packages_security_test
1 compromised version
- Jun 20, 2022
Malicious code in @worki/lib-candidate-common (npm)
- Jun 20, 2022
Malicious code in @sbbol/common (npm)
- Jun 20, 2022
Malicious code in @sbbol/business (npm)
- Jun 20, 2022
Malicious code in @media-ui/core (npm)
- Jun 20, 2022
Malware in @sbbol/business
1 compromised version
- Jun 20, 2022
Malware in @media-ui/core
1 compromised version
- Jun 20, 2022
Malware in @sbbol/common
1 compromised version
- Jun 20, 2022
Malware in @worki/lib-candidate-common
1 compromised version
- Jun 20, 2022
Malicious code in alicloud-ui3 (npm)
- Jun 20, 2022
Malicious code in alicloud-components (npm)
- Jun 20, 2022
Malicious code in @sbbol/web-library (npm)
- Jun 20, 2022
Malicious code in @sbbol/icons (npm)
- Jun 20, 2022
Malware in alicloud-ui3
1 compromised version
Page 6464 of 6,634