Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,681 total in npm · sorted newest first- Jun 20, 2022
Malicious code in launcher-start-page (npm)
- Jun 20, 2022
Malicious code in elastic-apm-rum (npm)
- Jun 20, 2022
Malware in pingone-angular-registration
1 compromised version
- Jun 20, 2022
Malware in elastic-apm-rum
1 compromised version
- Jun 20, 2022
Malware in launcher-start-page
1 compromised version
- Jun 20, 2022
Malicious code in ing-orange-login-sca-es (npm)
- Jun 20, 2022
Malicious code in ing-app-login-sca-es (npm)
- Jun 20, 2022
Malicious code in @idse/core (npm)
- Jun 20, 2022
Malicious code in @idse/common-ui (npm)
- Jun 20, 2022
Malware in ing-app-login-sca-es
1 compromised version
- Jun 20, 2022
Malware in @idse/common-ui
1 compromised version
- Jun 20, 2022
Malware in ing-orange-login-sca-es
1 compromised version
- Jun 20, 2022
Malware in @idse/core
1 compromised version
- Jun 20, 2022
Malicious code in yelp-react-component-ynra (npm)
- Jun 20, 2022
Malicious code in pj-reporting-frontend (npm)
- Jun 20, 2022
Malicious code in ing.app.transactional (npm)
- Jun 20, 2022
Malicious code in imodel-query-agent (npm)
- Jun 20, 2022
Malware in pj-reporting-frontend
1 compromised version
- Jun 20, 2022
Malware in yelp-react-component-ynra
1 compromised version
- Jun 20, 2022
Malware in imodel-query-agent
1 compromised version
- Jun 20, 2022
Malware in ing.app.transactional
1 compromised version
- Jun 20, 2022
Malicious code in wgversion (npm)
- Jun 20, 2022
Malicious code in three-d-secure (npm)
- Jun 20, 2022
Malicious code in siteversion (npm)
- Jun 20, 2022
Malicious code in local-payment (npm)
- Jun 20, 2022
Malware in local-payment
1 compromised version
- Jun 20, 2022
Malware in wgversion
1 compromised version
- Jun 20, 2022
Malware in siteversion
1 compromised version
- Jun 20, 2022
Malware in three-d-secure
1 compromised version
- Jun 20, 2022
Malicious code in yelp-react-component-photo-box (npm)
- Jun 20, 2022
Malicious code in yelp-biz-action-constants (npm)
- Jun 20, 2022
Malicious code in yahoo-react-pillbox (npm)
- Jun 20, 2022
Malicious code in yahoo-react-multi-select-box (npm)
- Jun 20, 2022
Malware in yahoo-react-pillbox
1 compromised version
- Jun 20, 2022
Malware in yelp-react-component-photo-box
1 compromised version
- Jun 20, 2022
Malware in yelp-biz-action-constants
1 compromised version
- Jun 20, 2022
Malware in yahoo-react-multi-select-box
1 compromised version
- Jun 20, 2022
Malicious code in project-with-joe (npm)
- Jun 20, 2022
Malicious code in deps-json-webpack-plugin (npm)
- Jun 20, 2022
Malicious code in dellingr (npm)
- Jun 20, 2022
Malicious code in @bugbounty-automation/deps-json-webpack-plugin (npm)
- Jun 20, 2022
Malware in project-with-joe
1 compromised version
- Jun 20, 2022
Malware in deps-json-webpack-plugin
1 compromised version
- Jun 20, 2022
Malware in @bugbounty-automation/deps-json-webpack-plugin
1 compromised version
- Jun 20, 2022
Malware in dellingr
1 compromised version
- Jun 20, 2022
Malicious code in xnxx-dl-wa-bot (npm)
- Jun 20, 2022
Malicious code in vaccineforbharat (npm)
- Jun 20, 2022
Malicious code in ups_node (npm)
- Jun 20, 2022
Malicious code in ketcher (npm)
- Jun 20, 2022
Malicious code in exoduscore (npm)
Page 6570 of 6,634