Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Jun 20, 2025
Malware in neuroglancer-rspack-project-source
1 compromised version
- Jun 20, 2025
Malware in zxdb
1 compromised version
- Jun 20, 2025
Malware in pipet-code-agent
1 compromised version
- Jun 20, 2025
Malware in wasm-wasi-core
1 compromised version
- Jun 20, 2025
Malware in automated-native-creatives
1 compromised version
- Jun 20, 2025
Malware in vscode-websearchforcopilot
1 compromised version
- Jun 20, 2025
Malware in traceviz-angular-core
1 compromised version
- Jun 20, 2025
Malware in vscode-azurestaticwebapps
1 compromised version
- Jun 20, 2025
Malware in vscode-spring-initializr
1 compromised version
- Jun 20, 2025
Malware in azure-pipeline-filter
1 compromised version
- Jun 20, 2025
Malware in calculator-sse
1 compromised version
- Jun 20, 2025
Malware in com.google.play.appupdate
1 compromised version
- Jun 20, 2025
Malware in odyssee_teams_api
1 compromised version
- Jun 19, 2025
Malicious code in math-utils-gava (npm)
- Jun 19, 2025
Malicious code in dynamic-global-wallet (npm)
- Jun 19, 2025
Malicious code in hackshack-leaderboard (npm)
- Jun 19, 2025
Malware in vscode-docker
1 compromised version
- Jun 19, 2025
Malware in azure-pipelines
1 compromised version
- Jun 19, 2025
Malware in microviewreact
1 compromised version
- Jun 19, 2025
Malware in client-vue3-dev
1 compromised version
- Jun 19, 2025
Malware in axiom-src
1 compromised version
- Jun 19, 2025
Malware in libsyncrpc
1 compromised version
- Jun 19, 2025
Malware in atom-keybindings
1 compromised version
- Jun 19, 2025
Malicious code in stickycta (npm)
1 compromised version
- Jun 19, 2025
Malicious code in vscode-docker (npm)
- Jun 19, 2025
Malicious code in azure-pipelines (npm)
- Jun 19, 2025
Malicious code in tap-bar (npm)
1 compromised version
- Jun 19, 2025
Malicious code in drivers-kit (npm)
1 compromised version
- Jun 19, 2025
Malicious code in axiom-src (npm)
- Jun 19, 2025
Malicious code in libsyncrpc (npm)
- Jun 19, 2025
Malicious code in atom-keybindings (npm)
- Jun 19, 2025
Malware in consumerweb-captcha
1 compromised version
- Jun 19, 2025
Malicious code in my-not-confused-packages (npm)
1 compromised version
- Jun 19, 2025
Malicious code in styleprefix (npm)
- Jun 19, 2025
Malware in styleprefix
1 compromised version
- Jun 19, 2025
Malicious code in test-package-vans (npm)
1 compromised version
- Jun 19, 2025
Malicious code in web-speed-test (npm)
- Jun 19, 2025
Malicious code in mattermost-hardware-keyboard (npm)
- Jun 19, 2025
Malware in sentry-docs
1 compromised version
- Jun 19, 2025
Malware in typescript-aurelia-api
1 compromised version
- Jun 19, 2025
Malware in web-speed-test
1 compromised version
- Jun 19, 2025
Malware in justsupport
1 compromised version
- Jun 19, 2025
Malware in mattermost-hardware-keyboard
1 compromised version
- Jun 19, 2025
Malicious code in api-mojang (npm)
- Jun 19, 2025
Malware in api-mojang
1 compromised version
- Jun 19, 2025
Malicious code in internallib_v210 (npm)
- Jun 19, 2025
Malware in internallib_v210
1 compromised version
- Jun 19, 2025
Malware in tcp-app-activation-react
1 compromised version
- Jun 19, 2025
Malware in ach-spa-facephi
1 compromised version
- Jun 19, 2025
Malicious code in node-orm-logger (npm)
Page 6274 of 7,293