Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malware in haven-design-system-static
1 compromised version
- Jun 20, 2022
Malicious code in kentik-viz (npm)
- Jun 20, 2022
Malicious code in fabric-vue (npm)
- Jun 20, 2022
Malicious code in fabric-design (npm)
- Jun 20, 2022
Malicious code in boss-alien-media-player (npm)
- Jun 20, 2022
Malware in fabric-design
1 compromised version
- Jun 20, 2022
Malware in fabric-vue
1 compromised version
- Jun 20, 2022
Malware in kentik-viz
1 compromised version
- Jun 20, 2022
Malware in boss-alien-media-player
1 compromised version
- Jun 20, 2022
Malicious code in nw-api-sdk (npm)
- Jun 20, 2022
Malicious code in note-taking (npm)
- Jun 20, 2022
Malicious code in deneuve-package-parent (npm)
- Jun 20, 2022
Malicious code in deneuve-package-ok (npm)
- Jun 20, 2022
Malware in deneuve-package-parent
1 compromised version
- Jun 20, 2022
Malware in note-taking
1 compromised version
- Jun 20, 2022
Malware in deneuve-package-ok
1 compromised version
- Jun 20, 2022
Malware in nw-api-sdk
1 compromised version
- Jun 20, 2022
Malicious code in react-popper-latest (npm)
- Jun 20, 2022
Malicious code in editor-sdk-react (npm)
- Jun 20, 2022
Malicious code in deneuve-package-test (npm)
- Jun 20, 2022
Malicious code in deneuve-package-private (npm)
- Jun 20, 2022
Malware in deneuve-package-private
1 compromised version
- Jun 20, 2022
Malware in editor-sdk-react
1 compromised version
- Jun 20, 2022
Malware in deneuve-package-test
1 compromised version
- Jun 20, 2022
Malware in react-popper-latest
1 compromised version
- Jun 20, 2022
Malicious code in vue-dexpot-dk (npm)
- Jun 20, 2022
Malicious code in @sfcc-core/logger (npm)
- Jun 20, 2022
Malicious code in @sfcc-core/core-graphql (npm)
- Jun 20, 2022
Malicious code in @sfcc-bff/productapi (npm)
- Jun 20, 2022
Malware in @sfcc-core/core-graphql
1 compromised version
- Jun 20, 2022
Malware in @sfcc-bff/productapi
1 compromised version
- Jun 20, 2022
Malware in @sfcc-core/logger
1 compromised version
- Jun 20, 2022
Malware in vue-dexpot-dk
1 compromised version
- Jun 20, 2022
Malicious code in @adnovum-eslint/eslint-plugin (npm)
- Jun 20, 2022
Malicious code in @sfcc-core/apiconfig (npm)
- Jun 20, 2022
Malicious code in @a4u/a4u-collection-react-spectrum-open-source-color-icons-release (npm)
- Jun 20, 2022
Malicious code in pratikyadavsm1 (npm)
- Jun 20, 2022
Malicious code in pratikyadavsm (npm)
- Jun 20, 2022
Malware in pratikyadavsm1
1 compromised version
- Jun 20, 2022
Malware in pratikyadavsm
1 compromised version
- Jun 20, 2022
Malware in @a4u/a4u-collection-react-spectrum-open-source-color-icons-release
1 compromised version
- Jun 20, 2022
Malware in @sfcc-core/apiconfig
1 compromised version
- Jun 20, 2022
Malware in @adnovum-eslint/eslint-plugin
1 compromised version
- Jun 20, 2022
Malicious code in @wso-utils/localization (npm)
- Jun 20, 2022
Malicious code in @wso-utils/json-mapper (npm)
- Jun 20, 2022
Malicious code in @wso-utils/form-utils (npm)
- Jun 20, 2022
Malicious code in sp-test-core (npm)
- Jun 20, 2022
Malware in @wso-utils/localization
1 compromised version
- Jun 20, 2022
Malware in @wso-utils/json-mapper
1 compromised version
- Jun 20, 2022
Malware in sp-test-core
1 compromised version
Page 6471 of 6,634