Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,738 total in npm · sorted newest first- Jun 20, 2022
Malicious code in agoric-servers (npm)
- Jun 20, 2022
Malicious code in upgrade-challenge (npm)
- Jun 20, 2022
Malicious code in npm-mega (npm)
- Jun 20, 2022
Malicious code in megamanz07007 (npm)
- Jun 20, 2022
Malicious code in megaman0072 (npm)
- Jun 20, 2022
Malicious code in helix-status-service (npm)
- Jun 20, 2022
Malicious code in helix-slack-notification (npm)
- Jun 20, 2022
Malicious code in helix-run-query (npm)
- Jun 20, 2022
Malicious code in helix-contentsource-connector (npm)
- Jun 20, 2022
Malicious code in git-dependency-maker (npm)
- Jun 20, 2022
Malicious code in dapp-inter-ui (npm)
- Jun 20, 2022
Malicious code in dapp-inter-agservers (npm)
- Jun 20, 2022
Malicious code in dapp-inter (npm)
- Jun 20, 2022
Malicious code in ashion-ingest (npm)
- Jun 20, 2022
Malware in ashion-ingest
1 compromised version
- Jun 20, 2022
Malware in megaman0072
1 compromised version
- Jun 20, 2022
Malware in git-dependency-maker
1 compromised version
- Jun 20, 2022
Malware in helix-status-service
1 compromised version
- Jun 20, 2022
Malware in dapp-inter
1 compromised version
- Jun 20, 2022
Malware in dapp-inter-ui
1 compromised version
- Jun 20, 2022
Malware in upgrade-challenge
1 compromised version
- Jun 20, 2022
Malware in agoric-servers
1 compromised version
- Jun 20, 2022
Malware in helix-run-query
1 compromised version
- Jun 20, 2022
Malware in npm-mega
1 compromised version
- Jun 20, 2022
Malware in dapp-inter-agservers
1 compromised version
- Jun 20, 2022
Malware in helix-slack-notification
1 compromised version
- Jun 20, 2022
Malware in megamanz07007
1 compromised version
- Jun 20, 2022
Malware in helix-contentsource-connector
1 compromised version
- Jun 20, 2022
Malicious code in action-publish-gh-pages (npm)
- Jun 20, 2022
Malicious code in action-create-release-pr (npm)
- Jun 20, 2022
Malicious code in webpack-vue-config (npm)
- Jun 20, 2022
Malicious code in ui-extensions-dev-console-app (npm)
- Jun 20, 2022
Malicious code in typescript-snap (npm)
- Jun 20, 2022
Malicious code in twofactor_totp (npm)
- Jun 20, 2022
Malicious code in template-snap-monorepo (npm)
- Jun 20, 2022
Malicious code in spaces-design (npm)
- Jun 20, 2022
Malicious code in snapcanvas-sdk (npm)
- Jun 20, 2022
Malicious code in slint-config-nodejs (npm)
- Jun 20, 2022
Malicious code in slack-notification (npm)
- Jun 20, 2022
Malicious code in shopify-marketplaces-buyer-app (npm)
- Jun 20, 2022
Malicious code in shopify-cli-extensions-test-utils (npm)
- Jun 20, 2022
Malicious code in sample-mini (npm)
- Jun 20, 2022
Malicious code in ruby-style-guide (npm)
- Jun 20, 2022
Malicious code in rnskia (npm)
- Jun 20, 2022
Malicious code in remote-ui (npm)
- Jun 20, 2022
Malicious code in react-native-performance-monorepo (npm)
- Jun 20, 2022
Malicious code in react-jesting-library (npm)
- Jun 20, 2022
Malicious code in polaris-for-vscode (npm)
- Jun 20, 2022
Malicious code in polaris-for-figma (npm)
- Jun 20, 2022
Malicious code in pcln-types (npm)
Page 6613 of 6,635