Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,804 total in npm · sorted newest first- Jun 20, 2022
Malware in epic-ue-themes-la
1 compromised version
- Jun 20, 2022
Malware in node-cron-master
1 compromised version
- Jun 20, 2022
Malicious code in test-credential (npm)
- Jun 20, 2022
Malicious code in synapse-access-control-1 (npm)
- Jun 20, 2022
Malicious code in shitshit2 (npm)
- Jun 20, 2022
Malware in shitshit2
1 compromised version
- Jun 20, 2022
Malware in synapse-access-control-1
1 compromised version
- Jun 20, 2022
Malware in test-credential
1 compromised version
- Jun 20, 2022
Malicious code in shitshit1 (npm)
- Jun 20, 2022
Malware in shitshit1
1 compromised version
- Jun 20, 2022
Malicious code in shitshit12 (npm)
- Jun 20, 2022
Malicious code in fstreamlalala (npm)
- Jun 20, 2022
Malicious code in fstream-pirlalala (npm)
- Jun 20, 2022
Malicious code in fstream-package-2 (npm)
- Jun 20, 2022
Malware in fstreamlalala
1 compromised version
- Jun 20, 2022
Malware in fstream-pirlalala
1 compromised version
- Jun 20, 2022
Malware in fstream-package-2
1 compromised version
- Jun 20, 2022
Malware in shitshit12
1 compromised version
- Jun 20, 2022
Malicious code in kakakaakaaa11aaa3_returns_hello_jfrog2a (npm)
- Jun 20, 2022
Malicious code in kakakaakaaa11aaa3_returns_hello_jfrog2 (npm)
- Jun 20, 2022
Malicious code in azure-template-cpp (npm)
- Jun 20, 2022
Malicious code in azure-container-registry-samples-ts (npm)
- Jun 20, 2022
Malicious code in azure-container-registry-samples-js (npm)
- Jun 20, 2022
Malware in kakakaakaaa11aaa3_returns_hello_jfrog2a
1 compromised version
- Jun 20, 2022
Malware in azure-template-cpp
1 compromised version
- Jun 20, 2022
Malware in kakakaakaaa11aaa3_returns_hello_jfrog2
1 compromised version
- Jun 20, 2022
Malware in azure-container-registry-samples-ts
1 compromised version
- Jun 20, 2022
Malware in azure-container-registry-samples-js
1 compromised version
- Jun 20, 2022
Malicious code in jobspecification (npm)
- Jun 20, 2022
Malicious code in iotc-migrator (npm)
- Jun 20, 2022
Malicious code in cloudjob (npm)
- Jun 20, 2022
Malicious code in azure-storage-common-cpp (npm)
- Jun 20, 2022
Malware in cloudjob
1 compromised version
- Jun 20, 2022
Malware in iotc-migrator
1 compromised version
- Jun 20, 2022
Malware in azure-storage-common-cpp
1 compromised version
- Jun 20, 2022
Malware in jobspecification
1 compromised version
- Jun 20, 2022
Malicious code in sql-action (npm)
- Jun 20, 2022
Malicious code in kubernetes-ingest (npm)
- Jun 20, 2022
Malicious code in blobindexfunc (npm)
- Jun 20, 2022
Malicious code in apimanagementclient (npm)
- Jun 20, 2022
Malware in kubernetes-ingest
1 compromised version
- Jun 20, 2022
Malware in blobindexfunc
1 compromised version
- Jun 20, 2022
Malware in sql-action
1 compromised version
- Jun 20, 2022
Malware in apimanagementclient
1 compromised version
- Jun 20, 2022
Malicious code in azure-storage-file-datalake-samples-ts (npm)
- Jun 20, 2022
Malicious code in azure-arm-labservices-samples-js-beta (npm)
- Jun 20, 2022
Malware in azure-storage-file-datalake-samples-ts
1 compromised version
- Jun 20, 2022
Malware in azure-arm-labservices-samples-js-beta
1 compromised version
- Jun 20, 2022
Malicious code in azure-arm-labservices-samples-ts-beta (npm)
- Jun 20, 2022
Malware in azure-arm-labservices-samples-ts-beta
1 compromised version
Page 6587 of 6,637