Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,509 total in npm · sorted newest first- Jun 20, 2022
Malicious code in doom-workers (npm)
- Jun 20, 2022
Malicious code in dd-sdk-reactnative-example (npm)
- Jun 20, 2022
Malicious code in dd-opentracing-cpp (npm)
- Jun 20, 2022
Malicious code in datadog-synthetics-github-action (npm)
- Jun 20, 2022
Malicious code in datadog-datadog_agent (npm)
- Jun 20, 2022
Malicious code in datadog-app-template (npm)
- Jun 20, 2022
Malicious code in datadog-app-stream-admin (npm)
- Jun 20, 2022
Malicious code in datadog-app-sentiment (npm)
- Jun 20, 2022
Malicious code in datadog-app-example-stream-admin (npm)
- Jun 20, 2022
Malicious code in datadog-app-example-sentiment (npm)
- Jun 20, 2022
Malicious code in datadog-app-example-random-dog-dog-image-widget (npm)
- Jun 20, 2022
Malicious code in datadog-app (npm)
- Jun 20, 2022
Malicious code in datadog-agent-github-action (npm)
- Jun 20, 2022
Malicious code in custom-pages-react-boilerplate (npm)
- Jun 20, 2022
Malicious code in collection-events-discord-webhook (npm)
- Jun 20, 2022
Malicious code in cdcrep-docs (npm)
- Jun 20, 2022
Malicious code in 0x-fee-wrapper-contract (npm)
- Jun 20, 2022
Malicious code in astrajs (npm)
- Jun 20, 2022
Malicious code in appsec-event-rules-tools (npm)
- Jun 20, 2022
Malware in dd-opentracing-cpp
1 compromised version
- Jun 20, 2022
Malware in datadog-synthetics-github-action
1 compromised version
- Jun 20, 2022
Malware in datadog-datadog_agent
1 compromised version
- Jun 20, 2022
Malware in io.intercom.cordova.sample
1 compromised version
- Jun 20, 2022
Malware in minicom-node
1 compromised version
- Jun 20, 2022
Malware in datadog-app-example-sentiment
1 compromised version
- Jun 20, 2022
Malware in doom-workers
1 compromised version
- Jun 20, 2022
Malware in frontegg
1 compromised version
- Jun 20, 2022
Malware in datadog-app-template
1 compromised version
- Jun 20, 2022
Malware in zcli-monorepo
1 compromised version
- Jun 20, 2022
Malware in dd-sdk-reactnative-example
1 compromised version
- Jun 20, 2022
Malware in upload-dsyms-github-action
1 compromised version
- Jun 20, 2022
Malware in datadog-app-stream-admin
1 compromised version
- Jun 20, 2022
Malware in opensea-erc1155
1 compromised version
- Jun 20, 2022
Malware in nodejs-driver
1 compromised version
- Jun 20, 2022
Malware in flipper-plugin-ribtree
1 compromised version
- Jun 20, 2022
Malware in datadog-app-example-stream-admin
1 compromised version
- Jun 20, 2022
Malware in opensea-creatures
1 compromised version
- Jun 20, 2022
Malware in procore-sample-ror
1 compromised version
- Jun 20, 2022
Malware in vuestic-admin
1 compromised version
- Jun 20, 2022
Malware in appsec-event-rules-tools
1 compromised version
- Jun 20, 2022
Malware in adelphi-api
1 compromised version
- Jun 20, 2022
Malware in datadog-app
1 compromised version
- Jun 20, 2022
Malware in datadog-agent-github-action
1 compromised version
- Jun 20, 2022
Malware in 0x-fee-wrapper-contract
1 compromised version
- Jun 20, 2022
Malware in custom-pages-react-boilerplate
1 compromised version
- Jun 20, 2022
Malware in frontegg-template-app
1 compromised version
- Jun 20, 2022
Malware in intercom-react-native.podspec
1 compromised version
- Jun 20, 2022
Malware in sdk_repl_app
1 compromised version
- Jun 20, 2022
Malware in frontegg-angular
1 compromised version
- Jun 20, 2022
Malware in collection-events-discord-webhook
1 compromised version
Page 6614 of 6,631