Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malicious code in com.unity.ide.vscode (npm)
- Jun 20, 2022
Malicious code in com.unity.ide.rider (npm)
- Jun 20, 2022
Malicious code in com.unity.collab-proxy (npm)
- Jun 20, 2022
Malicious code in com.unity.2d.sprite (npm)
- Jun 20, 2022
Malware in com.unity.collab-proxy
1 compromised version
- Jun 20, 2022
Malware in com.unity.ide.vscode
1 compromised version
- Jun 20, 2022
Malware in com.unity.ide.rider
1 compromised version
- Jun 20, 2022
Malware in adt-utils
1 compromised version
- Jun 20, 2022
Malware in com.unity.2d.sprite
1 compromised version
- Jun 20, 2022
Malicious code in titanite-javascript (npm)
- Jun 20, 2022
Malicious code in huddles-ui-templates (npm)
- Jun 20, 2022
Malicious code in huddles (npm)
- Jun 20, 2022
Malware in huddles
1 compromised version
- Jun 20, 2022
Malware in titanite-javascript
1 compromised version
- Jun 20, 2022
Malware in huddles-ui-templates
1 compromised version
- Jun 20, 2022
Malicious code in acswidget-waterfall (npm)
- Jun 20, 2022
Malicious code in ssnap-web (npm)
- Jun 20, 2022
Malicious code in fc-datalayer (npm)
- Jun 20, 2022
Malicious code in eslint-config-hfd (npm)
- Jun 20, 2022
Malware in acswidget-waterfall
1 compromised version
- Jun 20, 2022
Malware in ssnap-web
1 compromised version
- Jun 20, 2022
Malware in fc-datalayer
1 compromised version
- Jun 20, 2022
Malware in eslint-config-hfd
1 compromised version
- Jun 20, 2022
Malicious code in lamalo (npm)
- Jun 20, 2022
Malicious code in lamalamalama (npm)
- Jun 20, 2022
Malicious code in lamalama (npm)
- Jun 20, 2022
Malicious code in h1test (npm)
- Jun 20, 2022
Malicious code in fe-datalayer (npm)
- Jun 20, 2022
Malware in lamalamalama
1 compromised version
- Jun 20, 2022
Malware in fe-datalayer
1 compromised version
- Jun 20, 2022
Malware in lamalama
1 compromised version
- Jun 20, 2022
Malware in h1test
1 compromised version
- Jun 20, 2022
Malware in lamalo
1 compromised version
- Jun 20, 2022
Malicious code in stamjs (npm)
- Jun 20, 2022
Malicious code in dm-podcast-web-player (npm)
- Jun 20, 2022
Malicious code in da-uikit (npm)
- Jun 20, 2022
Malicious code in bubujs (npm)
- Jun 20, 2022
Malware in dm-podcast-web-player
1 compromised version
- Jun 20, 2022
Malware in da-uikit
1 compromised version
- Jun 20, 2022
Malware in stamjs
1 compromised version
- Jun 20, 2022
Malware in bubujs
1 compromised version
- Jun 20, 2022
Malicious code in analytics-event-schema (npm)
- Jun 20, 2022
Malicious code in streamer-market-dashboard (npm)
- Jun 20, 2022
Malicious code in react-overlays-wrapper (npm)
- Jun 20, 2022
Malicious code in common-pcode (npm)
- Jun 20, 2022
Malware in analytics-event-schema
1 compromised version
- Jun 20, 2022
Malware in common-pcode
1 compromised version
- Jun 20, 2022
Malware in streamer-market-dashboard
1 compromised version
- Jun 20, 2022
Malware in react-overlays-wrapper
1 compromised version
- Jun 20, 2022
Malicious code in ok-messenger-emoji (npm)
Page 6500 of 6,634