Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,681 total in npm · sorted newest first- Jun 20, 2022
Malware in markedjs
1 compromised version
- Jun 20, 2022
Malicious code in discord.js-selfbot-aployscr (npm)
- Jun 20, 2022
Malicious code in discord.js-selfbot-aploys (npm)
- Jun 20, 2022
Malicious code in discord.js-selfbot-aployed (npm)
- Jun 20, 2022
Malicious code in discord.js-aployscript-v11 (npm)
- Jun 20, 2022
Malware in discord.js-selfbot-aployed
1 compromised version
- Jun 20, 2022
Malware in discord.js-selfbot-aploys
1 compromised version
- Jun 20, 2022
Malware in discord.js-selfbot-aployscr
1 compromised version
- Jun 20, 2022
Malware in discord.js-aployscript-v11
1 compromised version
- Jun 20, 2022
Malicious code in @qw-app/fonts (npm)
- Jun 20, 2022
Malicious code in discord.js-selfbot-aployscript (npm)
- Jun 20, 2022
Malicious code in discord.js-selfbot-aploy (npm)
- Jun 20, 2022
Malicious code in aployscript (npm)
- Jun 20, 2022
Malware in aployscript
1 compromised version
- Jun 20, 2022
Malware in discord.js-selfbot-aploy
1 compromised version
- Jun 20, 2022
Malware in discord.js-selfbot-aployscript
1 compromised version
- Jun 20, 2022
Malware in @qw-app/fonts
1 compromised version
- Jun 20, 2022
Malicious code in @qw-app/react (npm)
- Jun 20, 2022
Malicious code in @qw-app/qiwi (npm)
- Jun 20, 2022
Malicious code in @qw-app/main (npm)
- Jun 20, 2022
Malicious code in @qw-app/index (npm)
- Jun 20, 2022
Malware in @qw-app/main
1 compromised version
- Jun 20, 2022
Malware in @qw-app/react
1 compromised version
- Jun 20, 2022
Malware in @qw-app/index
1 compromised version
- Jun 20, 2022
Malware in @qw-app/qiwi
1 compromised version
- Jun 20, 2022
Malicious code in smbikwmlz-isdfekvb-ewelcvpq (npm)
- Jun 20, 2022
Malicious code in @qw-app/modules (npm)
- Jun 20, 2022
Malicious code in @qw-app/images (npm)
- Jun 20, 2022
Malicious code in asana-api-explorer (npm)
- Jun 20, 2022
Malware in @qw-app/modules
1 compromised version
- Jun 20, 2022
Malware in asana-api-explorer
1 compromised version
- Jun 20, 2022
Malware in @qw-app/images
1 compromised version
- Jun 20, 2022
Malware in smbikwmlz-isdfekvb-ewelcvpq
1 compromised version
- Jun 20, 2022
Malicious code in react-native-fido-login-api (npm)
- Jun 20, 2022
Malicious code in makerjs-wrap-text (npm)
- Jun 20, 2022
Malicious code in ganache-core-coverage (npm)
- Jun 20, 2022
Malicious code in full-stack-recruitment-test (npm)
- Jun 20, 2022
Malware in react-native-fido-login-api
1 compromised version
- Jun 20, 2022
Malware in makerjs-wrap-text
1 compromised version
- Jun 20, 2022
Malware in full-stack-recruitment-test
1 compromised version
- Jun 20, 2022
Malware in ganache-core-coverage
1 compromised version
- Jun 20, 2022
Malicious code in ext-iconv-test1 (npm)
- Jun 20, 2022
Malicious code in ext-iconv-test-3 (npm)
- Jun 20, 2022
Malicious code in ext-iconv-test (npm)
- Jun 20, 2022
Malicious code in @eg-maps/commons (npm)
- Jun 20, 2022
Malware in @eg-maps/commons
1 compromised version
- Jun 20, 2022
Malware in ext-iconv-test-3
1 compromised version
- Jun 20, 2022
Malware in ext-iconv-test
1 compromised version
- Jun 20, 2022
Malware in ext-iconv-test1
1 compromised version
- Jun 20, 2022
Malicious code in netlify-testing-stuff (npm)
Page 6566 of 6,634