Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,142 total in npm · sorted newest first- Jun 8, 2022
Malware in jubilee-flag-wave
1 compromised version
- Jun 8, 2022
Malicious code in even-more-externals (npm)
- Jun 8, 2022
Malicious code in erc-20-lib (npm)
- Jun 8, 2022
Malware in erc-20-lib
1 compromised version
- Jun 8, 2022
Malware in even-more-externals
1 compromised version
- Jun 8, 2022
Malicious code in yarn-design-system-logos (npm)
- Jun 8, 2022
Malicious code in blockchain-explorer-sdk (npm)
- Jun 8, 2022
Malware in yarn-design-system-logos
1 compromised version
- Jun 8, 2022
Malware in blockchain-explorer-sdk
1 compromised version
- Jun 8, 2022
Malicious code in stripe-ms (npm)
- Jun 8, 2022
Malicious code in ms-2.0.0 (npm)
- Jun 8, 2022
Malicious code in informationbadges (npm)
- Jun 8, 2022
Malicious code in beachlean (npm)
- Jun 8, 2022
Malware in beachlean
1 compromised version
- Jun 8, 2022
Malware in informationbadges
1 compromised version
- Jun 8, 2022
Malware in stripe-ms
1 compromised version
- Jun 8, 2022
Malware in ms-2.0.0
1 compromised version
- Jun 8, 2022
Malicious code in sync-express (npm)
- Jun 8, 2022
Malicious code in pgk (npm)
- Jun 8, 2022
Malicious code in discord-js-v13 (npm)
- Jun 8, 2022
Malware in sync-express
1 compromised version
- Jun 8, 2022
Malware in discord-js-v13
1 compromised version
- Jun 8, 2022
Malware in pgk
1 compromised version
- Jun 8, 2022
Malicious code in dai-monorepo (npm)
- Jun 8, 2022
Malware in dai-monorepo
1 compromised version
- Jun 8, 2022
Malicious code in internal-scripts (npm)
- Jun 8, 2022
Malicious code in icepond (npm)
- Jun 8, 2022
Malware in icepond
1 compromised version
- Jun 8, 2022
Malware in internal-scripts
1 compromised version
- Jun 8, 2022
Malicious code in mock-solc-0.6 (npm)
- Jun 8, 2022
Malware in mock-solc-0.6
1 compromised version
- Jun 8, 2022
Malicious code in d2l-rubric-polymer (npm)
- Jun 8, 2022
Malicious code in d2l-rubric (npm)
- Jun 8, 2022
Malware in d2l-rubric-polymer
1 compromised version
- Jun 8, 2022
Malware in d2l-rubric
1 compromised version
- Jun 8, 2022
Malicious code in ddd-demo3 (npm)
- Jun 8, 2022
Malware in ddd-demo3
1 compromised version
- Jun 8, 2022
Malicious code in ddd-demo2 (npm)
- Jun 8, 2022
Malicious code in ddd-demo (npm)
- Jun 8, 2022
Malware in ddd-demo2
1 compromised version
- Jun 8, 2022
Malware in ddd-demo
1 compromised version
- Jun 3, 2022
Malicious code in nab-packages-react-utils-nab (npm)
- Jun 2, 2022
Malicious code in api-token-admin (npm)
- Jun 2, 2022
Malware in api-token-admin
1 compromised version
- Jun 2, 2022
Malicious code in stylis-ifl4 (npm)
- Jun 2, 2022
Malware in stylis-ifl4
1 compromised version
- Jun 2, 2022
Malicious code in color-xzibit (npm)
- Jun 2, 2022
Malware in color-xzibit
1 compromised version
- Jun 2, 2022
Malicious code in discordjs-selfbotjs (npm)
- Jun 2, 2022
Malware in discordjs-selfbotjs
1 compromised version
Page 6653 of 6,663