Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,629 total · sorted newest first- Jul 15, 2025
Malicious code in loki-release (npm)
- Jul 15, 2025
Malicious code in lezer-promql-tree-viz (npm)
- Jul 15, 2025
Malicious code in grafana-strava-datasource (npm)
- Jul 15, 2025
Malicious code in grafana-amazonprometheus-datasource (npm)
- Jul 15, 2025
Malicious code in ezer-promql-tree-viz (npm)
- Jul 15, 2025
Malicious code in agent-configurator (npm)
- Jul 15, 2025
Malware in grafana-lokiexplore-app
1 compromised version
- Jul 15, 2025
Malware in loki-release
1 compromised version
- Jul 15, 2025
Malware in pyroscope-nodejs
1 compromised version
- Jul 15, 2025
Malware in k6-studio
1 compromised version
- Jul 15, 2025
Malware in grafana-amazonprometheus-datasource
1 compromised version
- Jul 15, 2025
Malware in shared-workflows
1 compromised version
- Jul 15, 2025
Malware in grafana-strava-datasource
1 compromised version
- Jul 15, 2025
Malware in lezer-promql-tree-viz
1 compromised version
- Jul 15, 2025
Malware in ezer-promql-tree-viz
1 compromised version
- Jul 15, 2025
Malware in agent-configurator
1 compromised version
- Jul 15, 2025
Malware in string-parser-utils
1 compromised version
- Jul 15, 2025
Malware in helioviewer.org
1 compromised version
- Jul 15, 2025
Malicious code in what_type_of_self_indulgent_sub-par_challenge_is_this (npm)
2 compromised versions
- Jul 15, 2025
Malicious code in pxsceneui-example-03 (npm)
- Jul 15, 2025
Malicious code in istio-feeder (npm)
- Jul 15, 2025
Malicious code in dark-switch (npm)
- Jul 15, 2025
Malware in istio-feeder
1 compromised version
- Jul 15, 2025
Malware in comcastapp
1 compromised version
- Jul 15, 2025
Malware in dark-switch
1 compromised version
- Jul 15, 2025
Malware in what_type_of_self_indulgent_sub-par_challenge_is_this
1 compromised version
- Jul 15, 2025
Malware in pxsceneui-example-03
1 compromised version
- Jul 15, 2025
Malware in baileys-cleaner
1 compromised version
- Jul 15, 2025
Malicious code in @vapc-ui/search-box (npm)
- Jul 15, 2025
Malicious code in @vapc-ui/font-icon (npm)
- Jul 15, 2025
Malicious code in @cpce/console-sub-app (npm)
- Jul 15, 2025
Malware in @vapc-ui/font-icon
1 compromised version
- Jul 15, 2025
Malware in @vapc-ui/search-box
1 compromised version
- Jul 15, 2025
Malware in @cpce/console-sub-app
1 compromised version
- Jul 15, 2025
Malicious code in @pmm-ux/asset-uploader (npm)
- Jul 15, 2025
Malware in @pmm-ux/asset-uploader
1 compromised version
- Jul 15, 2025
Malicious code in @indigo-web/material (npm)
39 compromised versions
- Jul 15, 2025
Malicious code in @indigo-mobile/material (npm)
24 compromised versions
- Jul 15, 2025
Malware in @indigo-mobile/material
1 compromised version
- Jul 15, 2025
Malware in @indigo-web/material
1 compromised version
- Jul 15, 2025
Malicious code in @indigo-multi/fonts (npm)
14 compromised versions
- Jul 15, 2025
Malware in @indigo-multi/fonts
1 compromised version
- Jul 15, 2025
Malicious code in vitejs-plugin-refresh (npm)
- Jul 15, 2025
Malicious code in jsonlis-conf (npm)
- Jul 15, 2025
Malware in jsonlis-conf
1 compromised version
- Jul 15, 2025
Malware in vitejs-plugin-refresh
1 compromised version
- Jul 15, 2025
Malware in test4-ross4
1 compromised version
- Jul 15, 2025
Malware in protos-gen-node
1 compromised version
- Jul 15, 2025
Malicious code in notifier-loggers (npm)
- Jul 15, 2025
Malicious code in js-prettier (npm)
Page 6247 of 7,293