Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,628 total · sorted newest first- Jun 26, 2025
Malware in rush-sdk-test
1 compromised version
- Jun 26, 2025
Malicious code in undeconf (npm)
1 compromised version
- Jun 26, 2025
Malicious code in jira-help-tips (npm)
1 compromised version
- Jun 26, 2025
Malicious code in jira-dashboard-items (npm)
1 compromised version
- Jun 26, 2025
Malicious code in justeat-storybook (npm)
1 compromised version
- Jun 26, 2025
Malicious code in netbsd-x64 (npm)
1 compromised version
- Jun 25, 2025
Malicious code in testetedep (npm)
1 compromised version
- Jun 25, 2025
Malicious code in bb-escape (npm)
1 compromised version
- Jun 25, 2025
Malicious code in load-nyc-config (npm)
- Jun 25, 2025
Malicious code in @bb-ui-utils/memoizer (npm)
3 compromised versions
- Jun 25, 2025
Malicious code in myuscis-material (npm)
1 compromised version
- Jun 25, 2025
Malicious code in aws-sdk-react-native-core (npm)
1 compromised version
- Jun 25, 2025
Malicious code in nstmrt-stf-api-poc (npm)
1 compromised version
- Jun 25, 2025
Malicious code in data-catalog-api-schema (npm)
- Jun 25, 2025
Malicious code in create-one-page-website (npm)
- Jun 25, 2025
Malicious code in cow-template (npm)
- Jun 25, 2025
Malicious code in cow-scripts (npm)
- Jun 25, 2025
Malicious code in @lebeaujeu/fake (npm)
- Jun 25, 2025
Malware in cow-scripts
1 compromised version
- Jun 25, 2025
Malware in create-one-page-website
1 compromised version
- Jun 25, 2025
Malware in cow-template
1 compromised version
- Jun 25, 2025
Malware in @lebeaujeu/fake
1 compromised version
- Jun 25, 2025
Malware in angular-intro
1 compromised version
- Jun 25, 2025
Malware in tap-bar
1 compromised version
- Jun 25, 2025
Malware in deere-ui-commonjs-shim
1 compromised version
- Jun 25, 2025
Malware in acme-analytics
1 compromised version
- Jun 25, 2025
Malware in @cybs-plugins/theme
1 compromised version
- Jun 25, 2025
Malware in drivers-kit
1 compromised version
- Jun 25, 2025
Malware in braintree-dropin
1 compromised version
- Jun 25, 2025
Malicious code in callsign-async-runner (npm)
- Jun 25, 2025
Malicious code in discourse-mf (npm)
- Jun 25, 2025
Malicious code in ce24 (npm)
- Jun 25, 2025
Malicious code in animations.less (npm)
- Jun 25, 2025
Malicious code in alicn (npm)
- Jun 25, 2025
Malicious code in media_videojs (npm)
- Jun 25, 2025
Malicious code in collab-app (npm)
- Jun 25, 2025
Malicious code in ember-glimmer (npm)
- Jun 25, 2025
Malicious code in core_block (npm)
- Jun 25, 2025
Malicious code in bar.app.bar_rights (npm)
- Jun 25, 2025
Malicious code in work_app (npm)
- Jun 25, 2025
Malicious code in ted-ui (npm)
- Jun 25, 2025
Malicious code in dropdown_styles.css (npm)
- Jun 25, 2025
Malicious code in pnp-resume (npm)
- Jun 25, 2025
Malicious code in irradiance (npm)
- Jun 25, 2025
Malicious code in ember-htmlbars (npm)
- Jun 25, 2025
Malicious code in demo-confusion (npm)
- Jun 25, 2025
Malware in aog-checker
1 compromised version
- Jun 25, 2025
Malware in taskcluster-db
1 compromised version
- Jun 25, 2025
Malware in demo-confusion
1 compromised version
- Jun 25, 2025
Malicious code in kwp-a-b-testing (npm)
Page 6270 of 7,293