Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,681 total in npm · sorted newest first- Jun 20, 2022
Malware in smc-extendsession
1 compromised version
- Jun 20, 2022
Malware in swift-docc-render
1 compromised version
- Jun 20, 2022
Malicious code in ucs-timepicker (npm)
- Jun 20, 2022
Malicious code in ucs-multi-series-line-chart (npm)
- Jun 20, 2022
Malicious code in ucs-map (npm)
- Jun 20, 2022
Malicious code in ucs-list (npm)
- Jun 20, 2022
Malicious code in tesla-pre-delivery-onboarding (npm)
- Jun 20, 2022
Malware in ucs-multi-series-line-chart
1 compromised version
- Jun 20, 2022
Malware in tesla-pre-delivery-onboarding
1 compromised version
- Jun 20, 2022
Malware in ucs-timepicker
1 compromised version
- Jun 20, 2022
Malware in ucs-map
1 compromised version
- Jun 20, 2022
Malware in ucs-list
1 compromised version
- Jun 20, 2022
Malicious code in vc-web (npm)
- Jun 20, 2022
Malicious code in usaa-analytics (npm)
- Jun 20, 2022
Malicious code in ui-dependency-confusion (npm)
- Jun 20, 2022
Malicious code in ucs-data-table (npm)
- Jun 20, 2022
Malicious code in ucs-availability-status-chart (npm)
- Jun 20, 2022
Malware in usaa-analytics
1 compromised version
- Jun 20, 2022
Malware in ucs-data-table
1 compromised version
- Jun 20, 2022
Malware in vc-web
1 compromised version
- Jun 20, 2022
Malware in ui-dependency-confusion
1 compromised version
- Jun 20, 2022
Malware in ucs-availability-status-chart
1 compromised version
- Jun 20, 2022
Malicious code in xo-webpack-config (npm)
- Jun 20, 2022
Malicious code in wjaxx-test (npm)
- Jun 20, 2022
Malicious code in web-commons (npm)
- Jun 20, 2022
Malware in wjaxx-test
1 compromised version
- Jun 20, 2022
Malware in web-commons
1 compromised version
- Jun 20, 2022
Malware in xo-webpack-config
1 compromised version
- Jun 20, 2022
Malicious code in yahoo-react-checkbox-group (npm)
- Jun 20, 2022
Malicious code in hs-promise-utils (npm)
- Jun 20, 2022
Malicious code in bender-lyaml-loader (npm)
- Jun 20, 2022
Malicious code in bananabr-dep-confusion (npm)
- Jun 20, 2022
Malicious code in azure-graphrbac (npm)
- Jun 20, 2022
Malware in bender-lyaml-loader
1 compromised version
- Jun 20, 2022
Malware in hs-promise-utils
1 compromised version
- Jun 20, 2022
Malware in azure-graphrbac
1 compromised version
- Jun 20, 2022
Malware in bananabr-dep-confusion
1 compromised version
- Jun 20, 2022
Malware in yahoo-react-checkbox-group
1 compromised version
- Jun 20, 2022
Malicious code in dcrtimegui (npm)
- Jun 20, 2022
Malicious code in curri-slack (npm)
- Jun 20, 2022
Malicious code in biz-vue-communications (npm)
- Jun 20, 2022
Malware in curri-slack
1 compromised version
- Jun 20, 2022
Malware in dcrtimegui
1 compromised version
- Jun 20, 2022
Malware in biz-vue-communications
1 compromised version
- Jun 20, 2022
Malicious code in tidal-contracts (npm)
- Jun 20, 2022
Malicious code in functionteszt (npm)
- Jun 20, 2022
Malicious code in dnsteszt (npm)
- Jun 20, 2022
Malicious code in barnbridge-frontend (npm)
- Jun 20, 2022
Malware in functionteszt
1 compromised version
- Jun 20, 2022
Malware in tidal-contracts
1 compromised version
Page 6515 of 6,634