Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,142 total in npm · sorted newest first- Jun 8, 2022
Malware in tangerine-state-viewer
1 compromised version
- Jun 8, 2022
Malware in zilliqa-exchange-tutorial
1 compromised version
- Jun 8, 2022
Malware in misk-web-tab-app
1 compromised version
- Jun 8, 2022
Malware in kruit
1 compromised version
- Jun 8, 2022
Malware in zilliqa-social-pay
1 compromised version
- Jun 8, 2022
Malware in misk-web-tab-web-actions
1 compromised version
- Jun 8, 2022
Malware in misk-web-tab-template-basic
1 compromised version
- Jun 8, 2022
Malware in misk-web-tab-config
1 compromised version
- Jun 8, 2022
Malware in ai-aws-manager
1 compromised version
- Jun 8, 2022
Malware in neo-savant
1 compromised version
- Jun 8, 2022
Malware in misk-web-docs
1 compromised version
- Jun 8, 2022
Malware in scilla
1 compromised version
- Jun 8, 2022
Malware in z-wallet
1 compromised version
- Jun 8, 2022
Malware in nucleus-wallet
1 compromised version
- Jun 8, 2022
Malware in scilla-server
1 compromised version
- Jun 8, 2022
Malicious code in ai-cluster-manager (npm)
- Jun 8, 2022
Malicious code in vt-blockchain-bootcamp-starter-frontend (npm)
- Jun 8, 2022
Malicious code in universal-authenticator-library-js-example (npm)
- Jun 8, 2022
Malicious code in ual-reactjs-renderer-example (npm)
- Jun 8, 2022
Malicious code in onepassword_events_api (npm)
- Jun 8, 2022
Malicious code in jira-frontend (npm)
- Jun 8, 2022
Malicious code in jira-cloud-for-sketch (npm)
- Jun 8, 2022
Malicious code in atlassian-sketch-plugin (npm)
- Jun 8, 2022
Malware in ai-cluster-manager
1 compromised version
- Jun 8, 2022
Malware in jira-frontend
1 compromised version
- Jun 8, 2022
Malware in ual-reactjs-renderer-example
1 compromised version
- Jun 8, 2022
Malware in atlassian-sketch-plugin
1 compromised version
- Jun 8, 2022
Malware in universal-authenticator-library-js-example
1 compromised version
- Jun 8, 2022
Malware in jira-cloud-for-sketch
1 compromised version
- Jun 8, 2022
Malware in vt-blockchain-bootcamp-starter-frontend
1 compromised version
- Jun 8, 2022
Malware in onepassword_events_api
1 compromised version
- Jun 8, 2022
Malicious code in yoti_2020 (npm)
- Jun 8, 2022
Malware in yoti_2020
1 compromised version
- Jun 8, 2022
Malicious code in node-dvnr (npm)
- Jun 8, 2022
Malicious code in ecobeeesss (npm)
- Jun 8, 2022
Malware in node-dvnr
1 compromised version
- Jun 8, 2022
Malware in ecobeeesss
1 compromised version
- Jun 8, 2022
Malicious code in test-depss (npm)
- Jun 8, 2022
Malware in test-depss
1 compromised version
- Jun 8, 2022
Malicious code in @blackice12/tiny (npm)
- Jun 8, 2022
Malware in @blackice12/tiny
1 compromised version
- Jun 8, 2022
Malicious code in cron-mail (npm)
- Jun 8, 2022
Malware in cron-mail
1 compromised version
- Jun 8, 2022
Malicious code in web3-upgrade (npm)
- Jun 8, 2022
Malware in web3-upgrade
1 compromised version
- Jun 8, 2022
Malicious code in eg-clickstream-sdk-js (npm)
- Jun 8, 2022
Malware in eg-clickstream-sdk-js
1 compromised version
- Jun 8, 2022
Malicious code in sorareshshsjs (npm)
- Jun 8, 2022
Malware in sorareshshsjs
1 compromised version
- Jun 8, 2022
Malicious code in jubilee-flag-wave (npm)
Page 6652 of 6,663