Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,681 total in npm · sorted newest first- Jun 20, 2022
Malware in alipay-js-jdk
1 compromised version
- Jun 20, 2022
Malware in qq-qrcode-login
1 compromised version
- Jun 20, 2022
Malware in huawei-js-sdk
1 compromised version
- Jun 20, 2022
Malware in qq-web-login
1 compromised version
- Jun 20, 2022
Malware in wechat-web-login
1 compromised version
- Jun 20, 2022
Malicious code in aliyun-js-sdk (npm)
- Jun 20, 2022
Malicious code in alicloud-js-sdk (npm)
- Jun 20, 2022
Malicious code in wechat-rn (npm)
- Jun 20, 2022
Malicious code in wechat-mobile (npm)
- Jun 20, 2022
Malware in aliyun-js-sdk
1 compromised version
- Jun 20, 2022
Malware in wechat-rn
1 compromised version
- Jun 20, 2022
Malware in alicloud-js-sdk
1 compromised version
- Jun 20, 2022
Malware in wechat-mobile
1 compromised version
- Jun 20, 2022
Malicious code in tencent-js-sdk (npm)
- Jun 20, 2022
Malicious code in protobufjs-databricks (npm)
- Jun 20, 2022
Malicious code in pingan-js-sdk (npm)
- Jun 20, 2022
Malicious code in lenovo-js-sdk (npm)
- Jun 20, 2022
Malware in protobufjs-databricks
1 compromised version
- Jun 20, 2022
Malware in tencent-js-sdk
1 compromised version
- Jun 20, 2022
Malware in lenovo-js-sdk
1 compromised version
- Jun 20, 2022
Malware in pingan-js-sdk
1 compromised version
- Jun 20, 2022
Malicious code in spark-pr-board (npm)
- Jun 20, 2022
Malicious code in helloadmin (npm)
- Jun 20, 2022
Malicious code in dpgs (npm)
- Jun 20, 2022
Malicious code in coupa-common-js (npm)
- Jun 20, 2022
Malware in helloadmin
1 compromised version
- Jun 20, 2022
Malware in dpgs
1 compromised version
- Jun 20, 2022
Malware in coupa-common-js
1 compromised version
- Jun 20, 2022
Malware in spark-pr-board
1 compromised version
- Jun 20, 2022
Malicious code in skfb-viewer-protocol (npm)
- Jun 20, 2022
Malicious code in @sravni/oh-my-got (npm)
- Jun 20, 2022
Malicious code in @ozon-bx/ui-components (npm)
- Jun 20, 2022
Malicious code in maps-theme (npm)
- Jun 20, 2022
Malware in skfb-viewer-protocol
1 compromised version
- Jun 20, 2022
Malware in @ozon-bx/ui-components
1 compromised version
- Jun 20, 2022
Malware in maps-theme
1 compromised version
- Jun 20, 2022
Malware in @sravni/oh-my-got
1 compromised version
- Jun 20, 2022
Malicious code in yahoo-react-select-box (npm)
- Jun 20, 2022
Malicious code in oh-my-got (npm)
- Jun 20, 2022
Malicious code in kakakaakaaa11aaa3 (npm)
- Jun 20, 2022
Malicious code in cschandragirisample (npm)
- Jun 20, 2022
Malware in kakakaakaaa11aaa3
1 compromised version
- Jun 20, 2022
Malware in yahoo-react-select-box
1 compromised version
- Jun 20, 2022
Malware in oh-my-got
1 compromised version
- Jun 20, 2022
Malware in cschandragirisample
1 compromised version
- Jun 20, 2022
Malicious code in angieslist-styleguide (npm)
- Jun 20, 2022
Malicious code in saddlebag-events (npm)
- Jun 20, 2022
Malicious code in ringrtc (npm)
- Jun 20, 2022
Malicious code in pf-web-build (npm)
- Jun 20, 2022
Malicious code in pcln-config (npm)
Page 6572 of 6,634