Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,886 total · sorted newest first- May 16, 2022
Malware in ual-content-page
1 compromised version
- May 16, 2022
Malware in npm_test_nothing
1 compromised version
- May 16, 2022
Malware in adroit-websdk-client
1 compromised version
- May 16, 2022
Malware in xo-locale
1 compromised version
- May 16, 2022
Malicious code in com.unity.render-pipelines.high-definition-config (npm)
- May 16, 2022
Malware in com.unity.render-pipelines.high-definition-config
1 compromised version
- May 16, 2022
Malicious code in com.unity.searcher (npm)
- May 16, 2022
Malicious code in com.unity.probuilder (npm)
- May 16, 2022
Malware in com.unity.searcher
1 compromised version
- May 16, 2022
Malware in com.unity.probuilder
1 compromised version
- May 16, 2022
Malicious code in speedy-ts-compiler (npm)
- May 16, 2022
Malware in speedy-ts-compiler
1 compromised version
- May 16, 2022
Malicious code in gfg-security-utilities (npm)
- May 16, 2022
Malware in gfg-security-utilities
1 compromised version
- May 16, 2022
Malicious code in payoneer-scripts (npm)
- May 16, 2022
Malware in payoneer-scripts
1 compromised version
- May 16, 2022
Malicious code in loaddash (npm)
- May 16, 2022
Malicious code in loadassh (npm)
- May 16, 2022
Malware in loaddash
1 compromised version
- May 16, 2022
Malware in loadassh
1 compromised version
- May 16, 2022
Malicious code in eslint-plugin-kavak (npm)
- May 16, 2022
Malware in eslint-plugin-kavak
1 compromised version
- May 13, 2022
Malicious code in personal-colorss (npm)
- May 13, 2022
Malware in personal-colorss
1 compromised version
- May 11, 2022
Malicious code in jquerry (npm)
- May 11, 2022
Malware in jquerry
1 compromised version
- May 10, 2022
malicious crate `rustdecimal`
- May 9, 2022
Malicious code in opsie (npm)
- May 9, 2022
Malware in opsie
1 compromised version
- Jan 3, 2022
Malicious code in bootstrap-feature (npm)
- Dec 27, 2021
Malicious code in lib-bb-html-sanitizer (npm)
- Dec 27, 2021
Malicious code in cxp-jquery (npm)
- Dec 24, 2021
Malicious code in digital-marketing-client (npm)
- Dec 24, 2021
Malicious code in dbp-polyfills (npm)
- Nov 15, 2021
Malicious code in portal-shell (npm)
- Sep 10, 2021
Prevent installation typosquatting malware
1 compromised version
Page 5118 of 5,118