Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malicious code in amazon-oss-attribution-builder (npm)
- Jun 20, 2022
Malicious code in one-question-survey (npm)
- Jun 20, 2022
Malicious code in firefox-send (npm)
- Jun 20, 2022
Malware in amazonlauncherintegration
1 compromised version
- Jun 20, 2022
Malware in amazon-oss-attribution-builder
1 compromised version
- Jun 20, 2022
Malware in firefox-send
1 compromised version
- Jun 20, 2022
Malware in one-question-survey
1 compromised version
- Jun 20, 2022
Malicious code in vulncode-db (npm)
- Jun 20, 2022
Malicious code in dco-bot (npm)
- Jun 20, 2022
Malicious code in data-mil-thor-ww1 (npm)
- Jun 20, 2022
Malicious code in crossfeed (npm)
- Jun 20, 2022
Malware in vulncode-db
1 compromised version
- Jun 20, 2022
Malware in crossfeed
1 compromised version
- Jun 20, 2022
Malware in dco-bot
1 compromised version
- Jun 20, 2022
Malware in data-mil-thor-ww1
1 compromised version
- Jun 20, 2022
Malicious code in tarojs-plugin-platform-lark (npm)
- Jun 20, 2022
Malicious code in spaces-reach (npm)
- Jun 20, 2022
Malicious code in remote-dev-jobs-streamer (npm)
- Jun 20, 2022
Malicious code in fuv-app (npm)
- Jun 20, 2022
Malware in remote-dev-jobs-streamer
1 compromised version
- Jun 20, 2022
Malware in spaces-reach
1 compromised version
- Jun 20, 2022
Malware in fuv-app
1 compromised version
- Jun 20, 2022
Malware in tarojs-plugin-platform-lark
1 compromised version
- Jun 20, 2022
Malicious code in afeit (npm)
- Jun 20, 2022
Malicious code in twitterstreamingdemo (npm)
- Jun 20, 2022
Malicious code in 47cliens_server (npm)
- Jun 20, 2022
Malicious code in comment-watch-bot (npm)
- Jun 20, 2022
Malicious code in blank-ts-monorepo (npm)
- Jun 20, 2022
Malware in comment-watch-bot
1 compromised version
- Jun 20, 2022
Malware in afeit
1 compromised version
- Jun 20, 2022
Malware in 47cliens_server
1 compromised version
- Jun 20, 2022
Malware in twitterstreamingdemo
1 compromised version
- Jun 20, 2022
Malware in blank-ts-monorepo
1 compromised version
- Jun 20, 2022
Malicious code in inno-basic-server (npm)
- Jun 20, 2022
Malicious code in friendstimeline (npm)
- Jun 20, 2022
Malicious code in flp-njs (npm)
- Jun 20, 2022
Malicious code in envcomparator (npm)
- Jun 20, 2022
Malware in envcomparator
1 compromised version
- Jun 20, 2022
Malware in flp-njs
1 compromised version
- Jun 20, 2022
Malware in friendstimeline
1 compromised version
- Jun 20, 2022
Malware in inno-basic-server
1 compromised version
- Jun 20, 2022
Malicious code in ruby-on-rails-example (npm)
- Jun 20, 2022
Malicious code in find-legislators-web (npm)
- Jun 20, 2022
Malicious code in charting-library-react-example (npm)
- Jun 20, 2022
Malicious code in charting-library-angular5 (npm)
- Jun 20, 2022
Malware in charting-library-react-example
1 compromised version
- Jun 20, 2022
Malware in find-legislators-web
1 compromised version
- Jun 20, 2022
Malware in charting-library-angular5
1 compromised version
- Jun 20, 2022
Malware in ruby-on-rails-example
1 compromised version
- Jun 20, 2022
Malicious code in tracker-radar (npm)
Page 6485 of 6,634