Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,628 total · sorted newest first- Jul 2, 2025
Malware in discord-rpc-presence
1 compromised version
- Jul 2, 2025
Malicious code in jirawrapped (PyPI)
3 compromised versions
- Jul 2, 2025
Malware in proxyapi-docs
1 compromised version
- Jul 2, 2025
Malware in eslint-plugin-panel-ops
1 compromised version
- Jul 2, 2025
Malware in odin-backoffice-starter-kit
1 compromised version
- Jul 2, 2025
Malware in studiospanelopsweb
1 compromised version
- Jul 2, 2025
Malicious code in com.razer.chromasdk (npm)
1 compromised version
- Jul 2, 2025
Malware in maybe-i-would-like-a-banana
1 compromised version
- Jul 2, 2025
Malicious code in frontend-building_blocks (npm)
- Jul 2, 2025
Malware in frontend-building_blocks
1 compromised version
- Jul 2, 2025
Malware in meli-ai-chat-library
1 compromised version
- Jul 2, 2025
Malware in dx-chat-ai-client
1 compromised version
- Jul 2, 2025
Malware in nordic-dev-ts
1 compromised version
- Jul 2, 2025
Malware in i-just-f-hate-bananas-plz-dont-mind
1 compromised version
- Jul 2, 2025
Malware in babel-plugin-nordic-module-resolver
1 compromised version
- Jul 2, 2025
Malicious code in wp-stream (npm)
- Jul 2, 2025
Malicious code in twilio-webchat-widget (npm)
- Jul 2, 2025
Malicious code in karakeep (npm)
- Jul 2, 2025
Malicious code in ipmi-command (npm)
- Jul 2, 2025
Malware in es6modules-nodejs
1 compromised version
- Jul 2, 2025
Malware in karakeep
1 compromised version
- Jul 2, 2025
Malware in ipmi-command
1 compromised version
- Jul 2, 2025
Malware in wp-stream
1 compromised version
- Jul 2, 2025
Malware in twilio-webchat-widget
1 compromised version
- Jul 2, 2025
Malicious code in telehealth (npm)
- Jul 2, 2025
Malicious code in taskrouter-event-listener (npm)
- Jul 2, 2025
Malicious code in plugin-notes (npm)
- Jul 2, 2025
Malicious code in patient-appointment-management (npm)
- Jul 2, 2025
Malicious code in draw-with-twilio (npm)
- Jul 2, 2025
Malware in plugin-notes
1 compromised version
- Jul 2, 2025
Malware in patient-appointment-management
1 compromised version
- Jul 2, 2025
Malware in telehealth
1 compromised version
- Jul 2, 2025
Malware in taskrouter-event-listener
1 compromised version
- Jul 2, 2025
Malware in draw-with-twilio
1 compromised version
- Jul 2, 2025
Malicious code in servula (npm)
- Jul 2, 2025
Malicious code in reqweaver (npm)
- Jul 2, 2025
Malicious code in reqnexus (npm)
- Jul 2, 2025
Malware in reqnexus
1 compromised version
- Jul 2, 2025
Malware in reqweaver
1 compromised version
- Jul 2, 2025
Malware in servula
1 compromised version
- Jul 2, 2025
Malware in oneplussam
1 compromised version
- Jul 2, 2025
Malware in umd-package
1 compromised version
- Jul 2, 2025
Malware in es6-module-package
1 compromised version
- Jul 2, 2025
Malware in lard-o-matic
1 compromised version
- Jul 2, 2025
Malware in flag-package
1 compromised version
- Jul 2, 2025
Malware in side-effects-package
1 compromised version
- Jul 2, 2025
Malware in globals-package
1 compromised version
- Jul 2, 2025
Malicious code in azure-sentinel (npm)
- Jul 2, 2025
Malware in commonjs-quirks
1 compromised version
- Jul 2, 2025
Malware in prototype-poisoning-package
1 compromised version
Page 6263 of 7,293