Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malware in alicloud-components
1 compromised version
- Jun 20, 2022
Malware in @sbbol/web-library
1 compromised version
- Jun 20, 2022
Malware in @sbbol/icons
1 compromised version
- Jun 20, 2022
Malicious code in ae-global (npm)
- Jun 20, 2022
Malicious code in target-ui (npm)
- Jun 20, 2022
Malicious code in mcs-utils (npm)
- Jun 20, 2022
Malicious code in mailru-auth-gate (npm)
- Jun 20, 2022
Malware in ae-global
1 compromised version
- Jun 20, 2022
Malware in mcs-utils
1 compromised version
- Jun 20, 2022
Malware in mailru-auth-gate
1 compromised version
- Jun 20, 2022
Malware in target-ui
1 compromised version
- Jun 20, 2022
Malicious code in shodanio (npm)
- Jun 20, 2022
Malicious code in omh (npm)
- Jun 20, 2022
Malicious code in frontend-src (npm)
- Jun 20, 2022
Malicious code in driverportal (npm)
- Jun 20, 2022
Malware in shodanio
1 compromised version
- Jun 20, 2022
Malware in driverportal
1 compromised version
- Jun 20, 2022
Malware in omh
1 compromised version
- Jun 20, 2022
Malware in frontend-src
1 compromised version
- Jun 20, 2022
Malicious code in dklive-event-gateway (npm)
- Jun 20, 2022
Malicious code in com.thomsonreuters.project (npm)
- Jun 20, 2022
Malicious code in com.thomsonreuters.brandedtemplates-int (npm)
- Jun 20, 2022
Malicious code in blockstack-stats (npm)
- Jun 20, 2022
Malicious code in atlas-ui-framework (npm)
- Jun 20, 2022
Malware in atlas-ui-framework
1 compromised version
- Jun 20, 2022
Malware in com.thomsonreuters.brandedtemplates-int
1 compromised version
- Jun 20, 2022
Malware in dklive-event-gateway
1 compromised version
- Jun 20, 2022
Malware in blockstack-stats
1 compromised version
- Jun 20, 2022
Malware in com.thomsonreuters.project
1 compromised version
- Jun 20, 2022
Malicious code in ux-gulp-theming (npm)
- Jun 20, 2022
Malicious code in portal-web (npm)
- Jun 20, 2022
Malicious code in mindtap-static-lib (npm)
- Jun 20, 2022
Malicious code in dklive-admin-api (npm)
- Jun 20, 2022
Malware in ux-gulp-theming
1 compromised version
- Jun 20, 2022
Malware in dklive-admin-api
1 compromised version
- Jun 20, 2022
Malware in mindtap-static-lib
1 compromised version
- Jun 20, 2022
Malware in portal-web
1 compromised version
- Jun 20, 2022
Malicious code in zmp-cli-dev (npm)
- Jun 20, 2022
Malicious code in tv_home (npm)
- Jun 20, 2022
Malicious code in doffy-publish-to-npm (npm)
- Jun 20, 2022
Malicious code in debuug (npm)
- Jun 20, 2022
Malware in tv_home
1 compromised version
- Jun 20, 2022
Malware in zmp-cli-dev
1 compromised version
- Jun 20, 2022
Malware in doffy-publish-to-npm
1 compromised version
- Jun 20, 2022
Malware in debuug
1 compromised version
- Jun 20, 2022
Malicious code in tchalk (npm)
- Jun 20, 2022
Malicious code in slack-github-action (npm)
- Jun 20, 2022
Malicious code in request-progres (npm)
- Jun 20, 2022
Malicious code in isntal (npm)
- Jun 20, 2022
Malware in tchalk
1 compromised version
Page 6465 of 6,634