Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malicious code in grunt-retina-img (npm)
- Jun 20, 2022
Malicious code in grunt-retina-css (npm)
- Jun 20, 2022
Malicious code in co-browsing (npm)
- Jun 20, 2022
Malware in grunt-retina-css
1 compromised version
- Jun 20, 2022
Malware in grunt-retina-img
1 compromised version
- Jun 20, 2022
Malware in tinkoff-talk-web
1 compromised version
- Jun 20, 2022
Malware in co-browsing
1 compromised version
- Jun 20, 2022
Malicious code in shineout-mobile (npm)
- Jun 20, 2022
Malicious code in okapi-doc (npm)
- Jun 20, 2022
Malicious code in grunttools (npm)
- Jun 20, 2022
Malicious code in carousel-enabledx (npm)
- Jun 20, 2022
Malware in carousel-enabledx
1 compromised version
- Jun 20, 2022
Malware in okapi-doc
1 compromised version
- Jun 20, 2022
Malware in grunttools
1 compromised version
- Jun 20, 2022
Malware in shineout-mobile
1 compromised version
- Jun 20, 2022
Malicious code in @tampmd/utils (npm)
- Jun 20, 2022
Malicious code in @tampmd/hyperion-ui (npm)
- Jun 20, 2022
Malicious code in @tampmd/bth-react-components (npm)
- Jun 20, 2022
Malicious code in shein-icon (npm)
- Jun 20, 2022
Malware in shein-icon
1 compromised version
- Jun 20, 2022
Malware in @tampmd/utils
1 compromised version
- Jun 20, 2022
Malware in @tampmd/hyperion-ui
1 compromised version
- Jun 20, 2022
Malware in @tampmd/bth-react-components
1 compromised version
- Jun 20, 2022
Malicious code in usaa-url-manager (npm)
- Jun 20, 2022
Malicious code in usaa-messaging (npm)
- Jun 20, 2022
Malicious code in usaa-accessible-text (npm)
- Jun 20, 2022
Malicious code in @mcm-schema/valaution-service (npm)
- Jun 20, 2022
Malware in usaa-messaging
1 compromised version
- Jun 20, 2022
Malware in @mcm-schema/valaution-service
1 compromised version
- Jun 20, 2022
Malware in usaa-accessible-text
1 compromised version
- Jun 20, 2022
Malware in usaa-url-manager
1 compromised version
- Jun 20, 2022
Malicious code in test-proj-for-myself (npm)
- Jun 20, 2022
Malicious code in tazata (npm)
- Jun 20, 2022
Malicious code in ok-messenger-model (npm)
- Jun 20, 2022
Malicious code in music-ui (npm)
- Jun 20, 2022
Malicious code in covisint (npm)
- Jun 20, 2022
Malware in tazata
1 compromised version
- Jun 20, 2022
Malware in ok-messenger-model
1 compromised version
- Jun 20, 2022
Malware in music-ui
1 compromised version
- Jun 20, 2022
Malware in covisint
1 compromised version
- Jun 20, 2022
Malware in test-proj-for-myself
1 compromised version
- Jun 20, 2022
Malicious code in xyz-maps-core (npm)
- Jun 20, 2022
Malicious code in wb-dev-build-settings (npm)
- Jun 20, 2022
Malicious code in safehaven-sdk (npm)
- Jun 20, 2022
Malicious code in buy-button-storefront (npm)
- Jun 20, 2022
Malware in wb-dev-build-settings
1 compromised version
- Jun 20, 2022
Malware in buy-button-storefront
1 compromised version
- Jun 20, 2022
Malware in safehaven-sdk
1 compromised version
- Jun 20, 2022
Malware in xyz-maps-core
1 compromised version
- Jun 20, 2022
Malicious code in scheduler-0-13 (npm)
Page 6502 of 6,634