Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malware in energy-strategies
1 compromised version
- Jun 20, 2022
Malicious code in googleioweb (npm)
- Jun 20, 2022
Malicious code in gae-scaffold (npm)
- Jun 20, 2022
Malicious code in fusion-tables-drive-export (npm)
- Jun 20, 2022
Malicious code in fusion-tables-archive-visualizer (npm)
- Jun 20, 2022
Malicious code in fuchsiaware (npm)
- Jun 20, 2022
Malware in gae-scaffold
1 compromised version
- Jun 20, 2022
Malware in fusion-tables-drive-export
1 compromised version
- Jun 20, 2022
Malware in fuchsiaware
1 compromised version
- Jun 20, 2022
Malware in fusion-tables-archive-visualizer
1 compromised version
- Jun 20, 2022
Malware in googleioweb
1 compromised version
- Jun 20, 2022
Malicious code in inspector-spacetime (npm)
- Jun 20, 2022
Malicious code in gvisor-website (npm)
- Jun 20, 2022
Malicious code in googlesitekit (npm)
- Jun 20, 2022
Malware in inspector-spacetime
1 compromised version
- Jun 20, 2022
Malware in googlesitekit
1 compromised version
- Jun 20, 2022
Malware in gvisor-website
1 compromised version
- Jun 20, 2022
Malicious code in mirror-branch-action (npm)
- Jun 20, 2022
Malicious code in libhidtelephony (npm)
- Jun 20, 2022
Malicious code in language-jsonnet (npm)
- Jun 20, 2022
Malicious code in instanthangouts (npm)
- Jun 20, 2022
Malware in language-jsonnet
1 compromised version
- Jun 20, 2022
Malware in libhidtelephony
1 compromised version
- Jun 20, 2022
Malware in instanthangouts
1 compromised version
- Jun 20, 2022
Malware in mirror-branch-action
1 compromised version
- Jun 20, 2022
Malicious code in ota-analyzer (npm)
- Jun 20, 2022
Malicious code in nomulus (npm)
- Jun 20, 2022
Malicious code in mysteryofthethreebots (npm)
- Jun 20, 2022
Malicious code in model-viewer-packages (npm)
- Jun 20, 2022
Malware in ota-analyzer
1 compromised version
- Jun 20, 2022
Malware in mysteryofthethreebots
1 compromised version
- Jun 20, 2022
Malware in nomulus
1 compromised version
- Jun 20, 2022
Malware in model-viewer-packages
1 compromised version
- Jun 20, 2022
Malicious code in pigweed (npm)
- Jun 20, 2022
Malicious code in paseos (npm)
- Jun 20, 2022
Malicious code in pagespeed-inslides (npm)
- Jun 20, 2022
Malicious code in ota-generator (npm)
- Jun 20, 2022
Malicious code in ot-toy (npm)
- Jun 20, 2022
Malware in pigweed
1 compromised version
- Jun 20, 2022
Malware in ota-generator
1 compromised version
- Jun 20, 2022
Malware in pagespeed-inslides
1 compromised version
- Jun 20, 2022
Malware in paseos
1 compromised version
- Jun 20, 2022
Malware in ot-toy
1 compromised version
- Jun 20, 2022
Malicious code in processingjs-ide (npm)
- Jun 20, 2022
Malicious code in prefetchalyzer (npm)
- Jun 20, 2022
Malicious code in poseshield (npm)
- Jun 20, 2022
Malware in prefetchalyzer
1 compromised version
- Jun 20, 2022
Malware in processingjs-ide
1 compromised version
- Jun 20, 2022
Malware in poseshield
1 compromised version
- Jun 20, 2022
Malicious code in reflowlist (npm)
Page 6482 of 6,634