Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,730 total in npm · sorted newest first- Jun 20, 2022
Malware in cord-19-ui
1 compromised version
- Jun 20, 2022
Malicious code in wiki-site (npm)
- Jun 20, 2022
Malicious code in webhooks-server (npm)
- Jun 20, 2022
Malicious code in nylas-webhooks-example (npm)
- Jun 20, 2022
Malicious code in inbox-zero (npm)
- Jun 20, 2022
Malware in webhooks-server
1 compromised version
- Jun 20, 2022
Malware in wiki-site
1 compromised version
- Jun 20, 2022
Malware in nylas-webhooks-example
1 compromised version
- Jun 20, 2022
Malware in inbox-zero
1 compromised version
- Jun 20, 2022
Malicious code in nylas-mail-all (npm)
- Jun 20, 2022
Malicious code in cloud-workers (npm)
- Jun 20, 2022
Malicious code in client-sync (npm)
- Jun 20, 2022
Malicious code in botslives (npm)
- Jun 20, 2022
Malware in client-sync
1 compromised version
- Jun 20, 2022
Malware in nylas-mail-all
1 compromised version
- Jun 20, 2022
Malware in botslives
1 compromised version
- Jun 20, 2022
Malware in cloud-workers
1 compromised version
- Jun 20, 2022
Malicious code in towo (npm)
- Jun 20, 2022
Malicious code in telescope-avatar (npm)
- Jun 20, 2022
Malicious code in klow (npm)
- Jun 20, 2022
Malicious code in appboy (npm)
- Jun 20, 2022
Malware in appboy
1 compromised version
- Jun 20, 2022
Malware in towo
1 compromised version
- Jun 20, 2022
Malware in klow
1 compromised version
- Jun 20, 2022
Malware in telescope-avatar
1 compromised version
- Jun 20, 2022
Malicious code in @harrysforge/universal-analytics-enhanced-ecommerce (npm)
- Jun 20, 2022
Malicious code in @harrysforge/transition (npm)
- Jun 20, 2022
Malicious code in @harrysforge/tooltip (npm)
- Jun 20, 2022
Malicious code in @harrysforge/token-provider (npm)
- Jun 20, 2022
Malware in @harrysforge/universal-analytics-enhanced-ecommerce
1 compromised version
- Jun 20, 2022
Malware in @harrysforge/transition
1 compromised version
- Jun 20, 2022
Malware in @harrysforge/tooltip
1 compromised version
- Jun 20, 2022
Malware in @harrysforge/token-provider
1 compromised version
- Jun 20, 2022
Malicious code in @harrysforge/text (npm)
- Jun 20, 2022
Malicious code in @harrysforge/subscription-sdk (npm)
- Jun 20, 2022
Malicious code in @harrysforge/storage (npm)
- Jun 20, 2022
Malicious code in @harrysforge/slide-in (npm)
- Jun 20, 2022
Malware in @harrysforge/subscription-sdk
1 compromised version
- Jun 20, 2022
Malware in @harrysforge/storage
1 compromised version
- Jun 20, 2022
Malware in @harrysforge/text
1 compromised version
- Jun 20, 2022
Malware in @harrysforge/slide-in
1 compromised version
- Jun 20, 2022
Malicious code in @harrysforge/select (npm)
- Jun 20, 2022
Malicious code in @harrysforge/product-displays (npm)
- Jun 20, 2022
Malicious code in @harrysforge/number-stepper (npm)
- Jun 20, 2022
Malicious code in @harrysforge/media-hero (npm)
- Jun 20, 2022
Malicious code in @harrysforge/input-field (npm)
- Jun 20, 2022
Malware in @harrysforge/number-stepper
1 compromised version
- Jun 20, 2022
Malware in @harrysforge/select
1 compromised version
- Jun 20, 2022
Malware in @harrysforge/product-displays
1 compromised version
- Jun 20, 2022
Malware in @harrysforge/media-hero
1 compromised version
Page 6498 of 6,635