Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malware in safari-prevent-zoom
1 compromised version
- Jun 20, 2022
Malicious code in vscode-npm-script (npm)
- Jun 20, 2022
Malicious code in typescript-dom-lib-generator (npm)
- Jun 20, 2022
Malicious code in firebase-extensions (npm)
- Jun 20, 2022
Malicious code in datanode-explorer (npm)
- Jun 20, 2022
Malicious code in dailymotion-sdk-js (npm)
- Jun 20, 2022
Malware in datanode-explorer
1 compromised version
- Jun 20, 2022
Malware in dailymotion-sdk-js
1 compromised version
- Jun 20, 2022
Malware in typescript-dom-lib-generator
1 compromised version
- Jun 20, 2022
Malware in vscode-npm-script
1 compromised version
- Jun 20, 2022
Malware in firebase-extensions
1 compromised version
- Jun 20, 2022
Malicious code in octoprint-slackbot (npm)
- Jun 20, 2022
Malicious code in id-docs.telenordigital.com (npm)
- Jun 20, 2022
Malicious code in code-oss-dev (npm)
- Jun 20, 2022
Malware in code-oss-dev
1 compromised version
- Jun 20, 2022
Malware in id-docs.telenordigital.com
1 compromised version
- Jun 20, 2022
Malware in octoprint-slackbot
1 compromised version
- Jun 20, 2022
Malicious code in testing_confusion_pkg (npm)
- Jun 20, 2022
Malicious code in slack-reacjilator (npm)
- Jun 20, 2022
Malicious code in oauth_tutorial (npm)
- Jun 20, 2022
Malicious code in internal_crypto_express_package (npm)
- Jun 20, 2022
Malicious code in eslint-config-hwit (npm)
- Jun 20, 2022
Malware in slack-reacjilator
1 compromised version
- Jun 20, 2022
Malware in internal_crypto_express_package
1 compromised version
- Jun 20, 2022
Malware in oauth_tutorial
1 compromised version
- Jun 20, 2022
Malware in eslint-config-hwit
1 compromised version
- Jun 20, 2022
Malware in testing_confusion_pkg
1 compromised version
- Jun 20, 2022
Malicious code in wegmae_act (npm)
- Jun 20, 2022
Malicious code in supcom-web (npm)
- Jun 20, 2022
Malicious code in collab-ui-angular (npm)
- Jun 20, 2022
Malicious code in collab-ui (npm)
- Jun 20, 2022
Malware in wegmae_act
1 compromised version
- Jun 20, 2022
Malware in collab-ui-angular
1 compromised version
- Jun 20, 2022
Malware in supcom-web
1 compromised version
- Jun 20, 2022
Malware in collab-ui
1 compromised version
- Jun 20, 2022
Malicious code in stanford-arcade (npm)
- Jun 20, 2022
Malicious code in private-eye (npm)
- Jun 20, 2022
Malicious code in osefo.ux (npm)
- Jun 20, 2022
Malicious code in lnbapi (npm)
- Jun 20, 2022
Malware in lnbapi
1 compromised version
- Jun 20, 2022
Malware in private-eye
1 compromised version
- Jun 20, 2022
Malware in osefo.ux
1 compromised version
- Jun 20, 2022
Malware in stanford-arcade
1 compromised version
- Jun 20, 2022
Malicious code in liveshare (npm)
- Jun 20, 2022
Malicious code in life.qq.com (npm)
- Jun 20, 2022
Malicious code in job_ee_ce (npm)
- Jun 20, 2022
Malicious code in itsn (npm)
- Jun 20, 2022
Malware in life.qq.com
1 compromised version
- Jun 20, 2022
Malware in job_ee_ce
1 compromised version
- Jun 20, 2022
Malware in itsn
1 compromised version
Page 6469 of 6,634