Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,681 total in npm · sorted newest first- Jun 20, 2022
Malware in dnsteszt
1 compromised version
- Jun 20, 2022
Malware in barnbridge-frontend
1 compromised version
- Jun 20, 2022
Malicious code in teller-protocol (npm)
- Jun 20, 2022
Malicious code in tellar-protocol (npm)
- Jun 20, 2022
Malicious code in fe-avaya-chat-client (npm)
- Jun 20, 2022
Malicious code in dforce-protocol (npm)
- Jun 20, 2022
Malicious code in barnbridge-dao (npm)
- Jun 20, 2022
Malware in tellar-protocol
1 compromised version
- Jun 20, 2022
Malware in barnbridge-dao
1 compromised version
- Jun 20, 2022
Malware in teller-protocol
1 compromised version
- Jun 20, 2022
Malware in fe-avaya-chat-client
1 compromised version
- Jun 20, 2022
Malware in dforce-protocol
1 compromised version
- Jun 20, 2022
Malicious code in vscode-shadowenv (npm)
- Jun 20, 2022
Malicious code in shopify-devtool (npm)
- Jun 20, 2022
Malicious code in shopify-app-node (npm)
- Jun 20, 2022
Malicious code in fitbit-connect-client-api (npm)
- Jun 20, 2022
Malware in fitbit-connect-client-api
1 compromised version
- Jun 20, 2022
Malware in shopify-app-node
1 compromised version
- Jun 20, 2022
Malware in vscode-shadowenv
1 compromised version
- Jun 20, 2022
Malware in shopify-devtool
1 compromised version
- Jun 20, 2022
Malicious code in react-js-buy (npm)
- Jun 20, 2022
Malicious code in planout-editor (npm)
- Jun 20, 2022
Malicious code in linter-rorybot (npm)
- Jun 20, 2022
Malicious code in grabplatform-sample (npm)
- Jun 20, 2022
Malware in react-js-buy
1 compromised version
- Jun 20, 2022
Malware in linter-rorybot
1 compromised version
- Jun 20, 2022
Malware in planout-editor
1 compromised version
- Jun 20, 2022
Malware in grabplatform-sample
1 compromised version
- Jun 20, 2022
Malicious code in site-template (npm)
- Jun 20, 2022
Malicious code in polaris-example-webpack (npm)
- Jun 20, 2022
Malicious code in polaris-example-create-react-app (npm)
- Jun 20, 2022
Malicious code in lyft-oss-website (npm)
- Jun 20, 2022
Malware in polaris-example-webpack
1 compromised version
- Jun 20, 2022
Malware in site-template
1 compromised version
- Jun 20, 2022
Malware in lyft-oss-website
1 compromised version
- Jun 20, 2022
Malware in polaris-example-create-react-app
1 compromised version
- Jun 20, 2022
Malicious code in tengxunnba (npm)
- Jun 20, 2022
Malicious code in reactnativeflipperexample (npm)
- Jun 20, 2022
Malicious code in polaris-example-nextjs (npm)
- Jun 20, 2022
Malicious code in hermes-parser-packages (npm)
- Jun 20, 2022
Malware in hermes-parser-packages
1 compromised version
- Jun 20, 2022
Malware in tengxunnba
1 compromised version
- Jun 20, 2022
Malware in polaris-example-nextjs
1 compromised version
- Jun 20, 2022
Malware in reactnativeflipperexample
1 compromised version
- Jun 20, 2022
Malicious code in vr-webpack (npm)
- Jun 20, 2022
Malicious code in showcar-tracking (npm)
- Jun 20, 2022
Malicious code in hx1-upsrv (npm)
- Jun 20, 2022
Malicious code in hubot-hostinger (npm)
- Jun 20, 2022
Malware in hubot-hostinger
1 compromised version
- Jun 20, 2022
Malware in showcar-tracking
1 compromised version
Page 6516 of 6,634