Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,748 total in npm · sorted newest first- Jun 20, 2022
Malicious code in assign-pr (npm)
- Jun 20, 2022
Malicious code in assign-issue (npm)
- Jun 20, 2022
Malicious code in apps-showcase (npm)
- Jun 20, 2022
Malicious code in angular-cloudinary-photo (npm)
- Jun 20, 2022
Malware in epam-promo
1 compromised version
- Jun 20, 2022
Malware in proof-generation-api
1 compromised version
- Jun 20, 2022
Malware in assign-pr
1 compromised version
- Jun 20, 2022
Malware in cs-task-runner
1 compromised version
- Jun 20, 2022
Malware in pages-plugins
1 compromised version
- Jun 20, 2022
Malware in plasma-website
1 compromised version
- Jun 20, 2022
Malware in doom-workers-site
1 compromised version
- Jun 20, 2022
Malware in do-worker
1 compromised version
- Jun 20, 2022
Malware in xp-ui
1 compromised version
- Jun 20, 2022
Malware in redux-data-model-documentation
1 compromised version
- Jun 20, 2022
Malware in react-datepicker-docs
1 compromised version
- Jun 20, 2022
Malware in sdk-release
1 compromised version
- Jun 20, 2022
Malware in cloudflare-docs
1 compromised version
- Jun 20, 2022
Malware in crypto-com-chain-wallet
1 compromised version
- Jun 20, 2022
Malware in miew-cli
1 compromised version
- Jun 20, 2022
Malware in wallet-options
1 compromised version
- Jun 20, 2022
Malware in research.cloudflare.com
1 compromised version
- Jun 20, 2022
Malware in apps-showcase
1 compromised version
- Jun 20, 2022
Malware in intercom-react-native-example
1 compromised version
- Jun 20, 2022
Malware in discourse-prepend-tags-in-topic-slug
1 compromised version
- Jun 20, 2022
Malware in web-sdk-mono-repo
1 compromised version
- Jun 20, 2022
Malware in platform-client
1 compromised version
- Jun 20, 2022
Malware in matic-docs
1 compromised version
- Jun 20, 2022
Malware in prerelease-registry
1 compromised version
- Jun 20, 2022
Malware in reorgs-frontend
1 compromised version
- Jun 20, 2022
Malware in cli-e2e
1 compromised version
- Jun 20, 2022
Malware in workers-airtable-form-handler
1 compromised version
- Jun 20, 2022
Malware in v3-monorepo
1 compromised version
- Jun 20, 2022
Malware in client-sdk-contract-tests
1 compromised version
- Jun 20, 2022
Malware in alpaca-oas
1 compromised version
- Jun 20, 2022
Malware in react-ldclient-default-values
1 compromised version
- Jun 20, 2022
Malware in theme-whale-light
1 compromised version
- Jun 20, 2022
Malware in helloreactnative
1 compromised version
- Jun 20, 2022
Malware in git-gatsby
1 compromised version
- Jun 20, 2022
Malware in assign-issue
1 compromised version
- Jun 20, 2022
Malware in web-scripts-monorepo
1 compromised version
- Jun 20, 2022
Malware in launchdarkly-cloudflare-worker-template
1 compromised version
- Jun 20, 2022
Malware in chain-desktop-wallet
1 compromised version
- Jun 20, 2022
Malware in th-simple-keyring
1 compromised version
- Jun 20, 2022
Malware in workers.cloudflare.com
1 compromised version
- Jun 20, 2022
Malware in workers-airtable-form
1 compromised version
- Jun 20, 2022
Malware in integration-framework
1 compromised version
- Jun 20, 2022
Malware in manualtestapp
1 compromised version
- Jun 20, 2022
Malware in toolbox-script
1 compromised version
- Jun 20, 2022
Malware in boilerplate-fig-autocomplete
1 compromised version
- Jun 20, 2022
Malware in blockchain-classic-wallet
1 compromised version
Page 6617 of 6,635