Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,743 total in npm · sorted newest first- Jun 20, 2022
Malware in cat-weather-widget
1 compromised version
- Jun 15, 2022
Malicious code in @prescreen/distillery (npm)
- Jun 15, 2022
Malware in @prescreen/distillery
1 compromised version
- Jun 15, 2022
Malicious code in flame-vali (npm)
- Jun 15, 2022
Malware in flame-vali
1 compromised version
- Jun 14, 2022
Malicious code in ngllibmanager (npm)
- Jun 14, 2022
Malware in ngllibmanager
1 compromised version
- Jun 14, 2022
Malicious code in dig-tokens (npm)
- Jun 14, 2022
Malware in dig-tokens
1 compromised version
- Jun 14, 2022
Malicious code in analytika-analytika-utils (npm)
- Jun 14, 2022
Malware in analytika-analytika-utils
1 compromised version
- Jun 14, 2022
Malicious code in @tide-web-apps/global-environments (npm)
- Jun 14, 2022
Malware in @tide-web-apps/global-environments
1 compromised version
- Jun 14, 2022
Malicious code in du_npm_integ (npm)
- Jun 14, 2022
Malicious code in du_npm_inte (npm)
- Jun 14, 2022
Malware in du_npm_integ
1 compromised version
- Jun 14, 2022
Malware in du_npm_inte
1 compromised version
- Jun 14, 2022
Malicious code in purple_team_midway_3 (npm)
- Jun 14, 2022
Malicious code in purple_team_midway_2 (npm)
- Jun 14, 2022
Malicious code in purple_team_midway (npm)
- Jun 14, 2022
Malware in purple_team_midway_3
1 compromised version
- Jun 14, 2022
Malware in purple_team_midway_2
1 compromised version
- Jun 14, 2022
Malware in purple_team_midway
1 compromised version
- Jun 14, 2022
Malicious code in storage-image-processing-api-functions (npm)
- Jun 14, 2022
Malicious code in pagetour-sdk.http (npm)
- Jun 14, 2022
Malicious code in bindingx-weex-plugin (npm)
- Jun 14, 2022
Malware in pagetour-sdk.http
1 compromised version
- Jun 14, 2022
Malware in storage-image-processing-api-functions
1 compromised version
- Jun 14, 2022
Malware in bindingx-weex-plugin
1 compromised version
- Jun 13, 2022
Malicious code in sp-bootstrap (npm)
- Jun 13, 2022
Malware in sp-bootstrap
1 compromised version
- Jun 13, 2022
Malicious code in vault-updater (npm)
- Jun 13, 2022
Malicious code in linkbubble-website (npm)
- Jun 13, 2022
Malicious code in link-bubble (npm)
- Jun 13, 2022
Malicious code in brave-research-participation-tool (npm)
- Jun 13, 2022
Malicious code in brave-ledger (npm)
- Jun 13, 2022
Malicious code in brave-ios (npm)
- Jun 13, 2022
Malicious code in brave-eyeshade (npm)
- Jun 13, 2022
Malicious code in brave-extension (npm)
- Jun 13, 2022
Malicious code in brave-core-crx-packager (npm)
- Jun 13, 2022
Malware in link-bubble
1 compromised version
- Jun 13, 2022
Malware in linkbubble-website
1 compromised version
- Jun 13, 2022
Malware in brave-ios
1 compromised version
- Jun 13, 2022
Malware in brave-extension
1 compromised version
- Jun 13, 2022
Malware in brave-ledger
1 compromised version
- Jun 13, 2022
Malware in brave-eyeshade
1 compromised version
- Jun 13, 2022
Malware in brave-research-participation-tool
1 compromised version
- Jun 13, 2022
Malware in vault-updater
1 compromised version
- Jun 13, 2022
Malware in brave-core-crx-packager
1 compromised version
- Jun 13, 2022
Malicious code in web-discovery-project (npm)
Page 6620 of 6,635