Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,681 total in npm · sorted newest first- Jun 20, 2022
Malware in web-workers-js
1 compromised version
- Jun 20, 2022
Malware in monitor-query
1 compromised version
- Jun 20, 2022
Malicious code in web-workers-ts (npm)
- Jun 20, 2022
Malicious code in storage-internal-avro (npm)
- Jun 20, 2022
Malicious code in keyvault-common (npm)
- Jun 20, 2022
Malicious code in cors-typescript (npm)
- Jun 20, 2022
Malware in storage-internal-avro
1 compromised version
- Jun 20, 2022
Malware in cors-typescript
1 compromised version
- Jun 20, 2022
Malware in web-workers-ts
1 compromised version
- Jun 20, 2022
Malware in keyvault-common
1 compromised version
- Jun 20, 2022
Malicious code in vtstock (npm)
- Jun 20, 2022
Malicious code in @hrsites/fb-with-city-suggests (npm)
- Jun 20, 2022
Malicious code in com.unity.xr.windowsmr (npm)
- Jun 20, 2022
Malicious code in com.unity.barracuda (npm)
- Jun 20, 2022
Malicious code in com.microsoft.mixedreality.toolkit.foundation (npm)
- Jun 20, 2022
Malware in vtstock
1 compromised version
- Jun 20, 2022
Malware in com.unity.barracuda
1 compromised version
- Jun 20, 2022
Malware in com.unity.xr.windowsmr
1 compromised version
- Jun 20, 2022
Malware in com.microsoft.mixedreality.toolkit.foundation
1 compromised version
- Jun 20, 2022
Malware in @hrsites/fb-with-city-suggests
1 compromised version
- Jun 20, 2022
Malicious code in @azure-tests/perf-core-rest-pipeline (npm)
- Jun 20, 2022
Malicious code in @azure-tests/perf-ai-text-analytics (npm)
- Jun 20, 2022
Malicious code in color2.0.1 (npm)
- Jun 20, 2022
Malicious code in @azure-tests/perf-data-tables (npm)
- Jun 20, 2022
Malware in color2.0.1
1 compromised version
- Jun 20, 2022
Malware in @azure-tests/perf-ai-text-analytics
1 compromised version
- Jun 20, 2022
Malware in @azure-tests/perf-core-rest-pipeline
1 compromised version
- Jun 20, 2022
Malware in @azure-tests/perf-data-tables
1 compromised version
- Jun 20, 2022
Malicious code in @azure-tests/perf-ai-form-recognizer (npm)
- Jun 20, 2022
Malicious code in @azure-tests/perf-keyvault-secrets (npm)
- Jun 20, 2022
Malicious code in @azure-tests/perf-keyvault-keys (npm)
- Jun 20, 2022
Malicious code in @azure-tests/perf-keyvault-certificates (npm)
- Jun 20, 2022
Malware in @azure-tests/perf-ai-form-recognizer
1 compromised version
- Jun 20, 2022
Malware in @azure-tests/perf-keyvault-certificates
1 compromised version
- Jun 20, 2022
Malware in @azure-tests/perf-keyvault-secrets
1 compromised version
- Jun 20, 2022
Malware in @azure-tests/perf-keyvault-keys
1 compromised version
- Jun 20, 2022
Malicious code in @azure-tests/perf-template (npm)
- Jun 20, 2022
Malicious code in @azure-tests/perf-service-bus-track-1 (npm)
- Jun 20, 2022
Malicious code in @azure-tests/perf-service-bus (npm)
- Jun 20, 2022
Malicious code in @azure-tests/perf-identity (npm)
- Jun 20, 2022
Malware in @azure-tests/perf-template
1 compromised version
- Jun 20, 2022
Malware in @azure-tests/perf-service-bus-track-1
1 compromised version
- Jun 20, 2022
Malware in @azure-tests/perf-service-bus
1 compromised version
- Jun 20, 2022
Malware in @azure-tests/perf-identity
1 compromised version
- Jun 20, 2022
Malicious code in @azure-tests/perf-container-registry (npm)
- Jun 20, 2022
Malicious code in @azure-tests/perf-ai-metrics-advisor (npm)
- Jun 20, 2022
Malicious code in @azure-tests/perf-search-documents (npm)
- Jun 20, 2022
Malicious code in @azure-tests/perf-event-hubs (npm)
- Jun 20, 2022
Malware in @azure-tests/perf-ai-metrics-advisor
1 compromised version
- Jun 20, 2022
Malware in @azure-tests/perf-container-registry
1 compromised version
Page 6537 of 6,634