Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,681 total in npm · sorted newest first- Jun 20, 2022
Malicious code in geoadv-app (npm)
- Jun 20, 2022
Malicious code in geoadv-account (npm)
- Jun 20, 2022
Malware in geoadv-linters
1 compromised version
- Jun 20, 2022
Malware in geoadv-app
1 compromised version
- Jun 20, 2022
Malware in tribe-api
1 compromised version
- Jun 20, 2022
Malware in geoadv-account
1 compromised version
- Jun 20, 2022
Malicious code in react-dts-codegen (npm)
- Jun 20, 2022
Malicious code in geoadv-ts-codegen (npm)
- Jun 20, 2022
Malicious code in geoadv-proptypes-codegen (npm)
- Jun 20, 2022
Malicious code in geoadv-entities (npm)
- Jun 20, 2022
Malware in geoadv-entities
1 compromised version
- Jun 20, 2022
Malware in react-dts-codegen
1 compromised version
- Jun 20, 2022
Malware in geoadv-ts-codegen
1 compromised version
- Jun 20, 2022
Malware in geoadv-proptypes-codegen
1 compromised version
- Jun 20, 2022
Malicious code in staff-card (npm)
- Jun 20, 2022
Malicious code in bem-xjst-static-analyzer (npm)
- Jun 20, 2022
Malicious code in auction2-im (npm)
- Jun 20, 2022
Malicious code in auction2-assets (npm)
- Jun 20, 2022
Malware in staff-card
1 compromised version
- Jun 20, 2022
Malware in auction2-assets
1 compromised version
- Jun 20, 2022
Malware in auction2-im
1 compromised version
- Jun 20, 2022
Malware in bem-xjst-static-analyzer
1 compromised version
- Jun 20, 2022
Malicious code in user-interface-kit (npm)
- Jun 20, 2022
Malicious code in @fbsystem/figma-messenger (npm)
- Jun 20, 2022
Malicious code in @fbsystem/figma-intern-shell (npm)
- Jun 20, 2022
Malicious code in @fbpay/sdk (npm)
- Jun 20, 2022
Malware in @fbsystem/figma-messenger
1 compromised version
- Jun 20, 2022
Malware in user-interface-kit
1 compromised version
- Jun 20, 2022
Malware in @fbsystem/figma-intern-shell
1 compromised version
- Jun 20, 2022
Malware in @fbpay/sdk
1 compromised version
- Jun 20, 2022
Malicious code in moodules (npm)
- Jun 20, 2022
Malicious code in @fbsystem/figma-graphql (npm)
- Jun 20, 2022
Malicious code in @fbpay/test-container-utils (npm)
- Jun 20, 2022
Malicious code in @fbpay/merchant-demo (npm)
- Jun 20, 2022
Malware in @fbpay/merchant-demo
1 compromised version
- Jun 20, 2022
Malware in @fbpay/test-container-utils
1 compromised version
- Jun 20, 2022
Malware in @fbsystem/figma-graphql
1 compromised version
- Jun 20, 2022
Malware in moodules
1 compromised version
- Jun 20, 2022
Malicious code in test-container-utils (npm)
- Jun 20, 2022
Malicious code in igrepoposide (npm)
- Jun 20, 2022
Malicious code in figma-intern-shell (npm)
- Jun 20, 2022
Malicious code in anpgvytdohnmusxxexicyoojcrmmzvartwuisqqtnaqolfyddhcfkpnrncyc (npm)
- Jun 20, 2022
Malware in figma-intern-shell
1 compromised version
- Jun 20, 2022
Malware in test-container-utils
1 compromised version
- Jun 20, 2022
Malware in igrepoposide
1 compromised version
- Jun 20, 2022
Malware in anpgvytdohnmusxxexicyoojcrmmzvartwuisqqtnaqolfyddhcfkpnrncyc
1 compromised version
- Jun 20, 2022
Malicious code in plugin-typings (npm)
- Jun 20, 2022
Malicious code in generatedloggerutils (npm)
- Jun 20, 2022
Malicious code in figma-scripts (npm)
- Jun 20, 2022
Malicious code in fb-arcanist-rpc (npm)
Page 6508 of 6,634