Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,809 total in npm · sorted newest first- Jun 20, 2022
Malicious code in ps-brands-assets (npm)
- Jun 20, 2022
Malicious code in moralis-websocket (npm)
- Jun 20, 2022
Malicious code in ibanking-shell (npm)
- Jun 20, 2022
Malware in moralis-websocket
1 compromised version
- Jun 20, 2022
Malware in ps-brands-assets
1 compromised version
- Jun 20, 2022
Malware in testmatrix
1 compromised version
- Jun 20, 2022
Malware in ibanking-shell
1 compromised version
- Jun 20, 2022
Malicious code in stylelint-config-pagseguro (npm)
- Jun 20, 2022
Malicious code in ps-request-ws (npm)
- Jun 20, 2022
Malicious code in ps-react-bootstrap (npm)
- Jun 20, 2022
Malicious code in ps-bootstrap (npm)
- Jun 20, 2022
Malicious code in ps-asymmetric-crypts (npm)
- Jun 20, 2022
Malware in ps-bootstrap
1 compromised version
- Jun 20, 2022
Malware in stylelint-config-pagseguro
1 compromised version
- Jun 20, 2022
Malware in ps-request-ws
1 compromised version
- Jun 20, 2022
Malware in ps-react-bootstrap
1 compromised version
- Jun 20, 2022
Malware in ps-asymmetric-crypts
1 compromised version
- Jun 20, 2022
Malicious code in stylelint-bem-validator (npm)
- Jun 20, 2022
Malicious code in ps-validations (npm)
- Jun 20, 2022
Malicious code in ps-crypt (npm)
- Jun 20, 2022
Malicious code in eslint-config-pagseguro (npm)
- Jun 20, 2022
Malware in eslint-config-pagseguro
1 compromised version
- Jun 20, 2022
Malware in ps-validations
1 compromised version
- Jun 20, 2022
Malware in stylelint-bem-validator
1 compromised version
- Jun 20, 2022
Malware in ps-crypt
1 compromised version
- Jun 20, 2022
Malicious code in ps-cart-recovery (npm)
- Jun 20, 2022
Malicious code in pagseguro-utils (npm)
- Jun 20, 2022
Malicious code in pagseguro-user-session (npm)
- Jun 20, 2022
Malicious code in cgfnc2vndxjvn (npm)
- Jun 20, 2022
Malware in pagseguro-utils
1 compromised version
- Jun 20, 2022
Malware in cgfnc2vndxjvn
1 compromised version
- Jun 20, 2022
Malware in pagseguro-user-session
1 compromised version
- Jun 20, 2022
Malware in ps-cart-recovery
1 compromised version
- Jun 20, 2022
Malicious code in jt.timepicker (npm)
- Jun 20, 2022
Malicious code in grunt-jsdoc-to-markdow (npm)
- Jun 20, 2022
Malicious code in greensock-js (npm)
- Jun 20, 2022
Malicious code in codebird-js (npm)
- Jun 20, 2022
Malware in greensock-js
1 compromised version
- Jun 20, 2022
Malware in grunt-jsdoc-to-markdow
1 compromised version
- Jun 20, 2022
Malware in codebird-js
1 compromised version
- Jun 20, 2022
Malware in jt.timepicker
1 compromised version
- Jun 20, 2022
Malicious code in string_decoder-browserify (npm)
- Jun 20, 2022
Malicious code in react-instantsearch-hooks-dom (npm)
- Jun 20, 2022
Malicious code in parcel-plugin-test (npm)
- Jun 20, 2022
Malicious code in other-item (npm)
- Jun 20, 2022
Malware in react-instantsearch-hooks-dom
1 compromised version
- Jun 20, 2022
Malware in other-item
1 compromised version
- Jun 20, 2022
Malware in string_decoder-browserify
1 compromised version
- Jun 20, 2022
Malware in parcel-plugin-test
1 compromised version
- Jun 20, 2022
Malicious code in yello133 (npm)
Page 6582 of 6,637