Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,681 total in npm · sorted newest first- Jun 20, 2022
Malicious code in paypal-express (npm)
- Jun 20, 2022
Malicious code in myetherwallet-kb-v5 (npm)
- Jun 20, 2022
Malicious code in myetherwallet-kb (npm)
- Jun 20, 2022
Malicious code in logi-bootstrap (npm)
- Jun 20, 2022
Malware in myetherwallet-kb
1 compromised version
- Jun 20, 2022
Malware in paypal-express
1 compromised version
- Jun 20, 2022
Malware in logi-bootstrap
1 compromised version
- Jun 20, 2022
Malware in myetherwallet-kb-v5
1 compromised version
- Jun 20, 2022
Malicious code in universal-token (npm)
- Jun 20, 2022
Malicious code in pingone-angular-sdk (npm)
- Jun 20, 2022
Malicious code in microsoft-bonsai-visualizer (npm)
- Jun 20, 2022
Malicious code in ethers-4 (npm)
- Jun 20, 2022
Malware in pingone-angular-sdk
1 compromised version
- Jun 20, 2022
Malware in microsoft-bonsai-visualizer
1 compromised version
- Jun 20, 2022
Malware in ethers-4
1 compromised version
- Jun 20, 2022
Malware in universal-token
1 compromised version
- Jun 20, 2022
Malicious code in a11y-speak (npm)
- Jun 20, 2022
Malicious code in zilliqa-testing-library (npm)
- Jun 20, 2022
Malicious code in reactidd (npm)
- Jun 20, 2022
Malicious code in dns-watcher-frontend (npm)
- Jun 20, 2022
Malware in reactidd
1 compromised version
- Jun 20, 2022
Malware in zilliqa-testing-library
1 compromised version
- Jun 20, 2022
Malware in dns-watcher-frontend
1 compromised version
- Jun 20, 2022
Malware in a11y-speak
1 compromised version
- Jun 20, 2022
Malicious code in thisisnothelloworld (npm)
- Jun 20, 2022
Malicious code in solc-0.4.13 (npm)
- Jun 20, 2022
Malicious code in bitcoinjs-lib-bigint (npm)
- Jun 20, 2022
Malicious code in bip174-bigint (npm)
- Jun 20, 2022
Malware in bip174-bigint
1 compromised version
- Jun 20, 2022
Malware in thisisnothelloworld
1 compromised version
- Jun 20, 2022
Malware in solc-0.4.13
1 compromised version
- Jun 20, 2022
Malware in bitcoinjs-lib-bigint
1 compromised version
- Jun 20, 2022
Malicious code in gittt101 (npm)
- Jun 20, 2022
Malicious code in gitnpmrce (npm)
- Jun 20, 2022
Malicious code in githubnpmrce101 (npm)
- Jun 20, 2022
Malicious code in githubnpmrce1 (npm)
- Jun 20, 2022
Malware in gittt101
1 compromised version
- Jun 20, 2022
Malware in githubnpmrce101
1 compromised version
- Jun 20, 2022
Malware in gitnpmrce
1 compromised version
- Jun 20, 2022
Malware in githubnpmrce1
1 compromised version
- Jun 20, 2022
Malicious code in aio-cli-config (npm)
- Jun 20, 2022
Malicious code in icons-vk (npm)
- Jun 20, 2022
Malicious code in gitnpmrceee90 (npm)
- Jun 20, 2022
Malicious code in dcrdex-assets (npm)
- Jun 20, 2022
Malicious code in browserslist-config-freight-trust (npm)
- Jun 20, 2022
Malicious code in blind-threshold-bls (npm)
- Jun 20, 2022
Malware in gitnpmrceee90
1 compromised version
- Jun 20, 2022
Malware in icons-vk
1 compromised version
- Jun 20, 2022
Malware in blind-threshold-bls
1 compromised version
- Jun 20, 2022
Malware in browserslist-config-freight-trust
1 compromised version
Page 6523 of 6,634