Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malicious code in ok-message-parser (npm)
- Jun 20, 2022
Malicious code in @msmg/vue-auth-tracking (npm)
- Jun 20, 2022
Malicious code in @msm-app/product-block (npm)
- Jun 20, 2022
Malware in @msmg/vue-auth-tracking
1 compromised version
- Jun 20, 2022
Malware in ok-message-parser
1 compromised version
- Jun 20, 2022
Malware in ok-messenger-emoji
1 compromised version
- Jun 20, 2022
Malware in @msm-app/product-block
1 compromised version
- Jun 20, 2022
Malicious code in @msmg/vue-uid (npm)
- Jun 20, 2022
Malicious code in @msmg/vue-merge-data-qa (npm)
- Jun 20, 2022
Malicious code in @msmg/tracking (npm)
- Jun 20, 2022
Malicious code in @msmg/gtm-events (npm)
- Jun 20, 2022
Malware in @msmg/tracking
1 compromised version
- Jun 20, 2022
Malware in @msmg/vue-uid
1 compromised version
- Jun 20, 2022
Malware in @msmg/gtm-events
1 compromised version
- Jun 20, 2022
Malware in @msmg/vue-merge-data-qa
1 compromised version
- Jun 20, 2022
Malicious code in @otvet/muse-ui (npm)
- Jun 20, 2022
Malicious code in @otvet/advertising (npm)
- Jun 20, 2022
Malicious code in my-oauth (npm)
- Jun 20, 2022
Malicious code in hubspot-url-utils (npm)
- Jun 20, 2022
Malware in hubspot-url-utils
1 compromised version
- Jun 20, 2022
Malware in @otvet/muse-ui
1 compromised version
- Jun 20, 2022
Malware in my-oauth
1 compromised version
- Jun 20, 2022
Malware in @otvet/advertising
1 compromised version
- Jun 20, 2022
Malicious code in visitor-ui-component-library-icons (npm)
- Jun 20, 2022
Malicious code in visitor-ui-component-library (npm)
- Jun 20, 2022
Malicious code in usage-tracker-core (npm)
- Jun 20, 2022
Malicious code in hs-promise-rejection-tracking (npm)
- Jun 20, 2022
Malicious code in hs-loadsh (npm)
- Jun 20, 2022
Malware in usage-tracker-core
1 compromised version
- Jun 20, 2022
Malware in visitor-ui-component-library
1 compromised version
- Jun 20, 2022
Malware in visitor-ui-component-library-icons
1 compromised version
- Jun 20, 2022
Malware in hs-promise-rejection-tracking
1 compromised version
- Jun 20, 2022
Malware in hs-loadsh
1 compromised version
- Jun 20, 2022
Malicious code in signup-ui-core (npm)
- Jun 20, 2022
Malicious code in feedback-utils (npm)
- Jun 20, 2022
Malicious code in feedback-schema (npm)
- Jun 20, 2022
Malicious code in conversations-prop-types (npm)
- Jun 20, 2022
Malware in conversations-prop-types
1 compromised version
- Jun 20, 2022
Malware in feedback-schema
1 compromised version
- Jun 20, 2022
Malware in signup-ui-core
1 compromised version
- Jun 20, 2022
Malware in feedback-utils
1 compromised version
- Jun 20, 2022
Malicious code in forms-embed-utils-lib (npm)
- Jun 20, 2022
Malicious code in feedback-web-renderer-ui (npm)
- Jun 20, 2022
Malicious code in cos-i18n (npm)
- Jun 20, 2022
Malicious code in asset-bender (npm)
- Jun 20, 2022
Malware in cos-i18n
1 compromised version
- Jun 20, 2022
Malware in feedback-web-renderer-ui
1 compromised version
- Jun 20, 2022
Malware in forms-embed-utils-lib
1 compromised version
- Jun 20, 2022
Malware in asset-bender
1 compromised version
- Jun 20, 2022
Malicious code in tinkoff-talk-web (npm)
Page 6501 of 6,634