Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Jun 17, 2025
Malware in prod-interno
1 compromised version
- Jun 17, 2025
Malware in gs-payments
1 compromised version
- Jun 17, 2025
Malware in mssql-internal
1 compromised version
- Jun 17, 2025
Malware in internal-logger
1 compromised version
- Jun 17, 2025
Malware in infra-metrics
1 compromised version
- Jun 17, 2025
Malware in internal-auth
1 compromised version
- Jun 17, 2025
Malware in dev-api-client
1 compromised version
- Jun 17, 2025
Malware in prod-shared
1 compromised version
- Jun 17, 2025
Malware in virtru-design-params
1 compromised version
- Jun 17, 2025
Malware in virtru-private
1 compromised version
- Jun 17, 2025
Malware in launch-darkly-provider
1 compromised version
- Jun 17, 2025
Malicious code in globalloadercontroller (npm)
1 compromised version
- Jun 17, 2025
Malicious code in worldhello (PyPI)
1 compromised version
- Jun 17, 2025
Malicious code in o11y-ds-frontend (npm)
1 compromised version
- Jun 17, 2025
Malicious code in @openapi-platform/git-util (npm)
1 compromised version
- Jun 17, 2025
Malware in buck2_explain
1 compromised version
- Jun 17, 2025
Malware in vscode-azurecontainerapps
1 compromised version
- Jun 17, 2025
Malware in debugger-local
1 compromised version
- Jun 17, 2025
Malware in symphony-scatterplot
1 compromised version
- Jun 17, 2025
Malware in snapshot-server
1 compromised version
- Jun 17, 2025
Malware in connectnodewebclient
1 compromised version
- Jun 17, 2025
Malware in google.fhir.stu3.google
1 compromised version
- Jun 17, 2025
Malicious code in @ftapi/secuauth (npm)
- Jun 17, 2025
Malicious code in vscode-azurestaticwebapps (npm)
1 compromised version
- Jun 17, 2025
Malicious code in csvvv (PyPI)
3 compromised versions
- Jun 17, 2025
Malicious code in reoregistration (npm)
2 compromised versions
- Jun 17, 2025
Malicious code in vscode-azurecontainerapps (npm)
1 compromised version
- Jun 17, 2025
Malicious code in vscode-websearchforcopilot (npm)
1 compromised version
- Jun 17, 2025
Malicious code in @ftapi/components (npm)
1 compromised version
- Jun 17, 2025
Malicious code in odyssee_teams_api (npm)
1 compromised version
- Jun 17, 2025
Malicious code in syscachelib (PyPI)
1 compromised version
- Jun 17, 2025
Malicious code in studiospanelopsweb (npm)
3 compromised versions
- Jun 17, 2025
Malicious code in cascading-picklists-extenstion (npm)
1 compromised version
- Jun 17, 2025
Malicious code in idse (npm)
3 compromised versions
- Jun 17, 2025
Malicious code in myatt (npm)
3 compromised versions
- Jun 17, 2025
Malicious code in @evg-ui/lib (npm)
1 compromised version
- Jun 17, 2025
Malicious code in @zyp3_/api-ecom-errors (npm)
- Jun 17, 2025
Malicious code in readium-shared-js (npm)
3 compromised versions
- Jun 16, 2025
Malicious code in just-config-data (npm)
3 compromised versions
- Jun 16, 2025
Malicious code in graphlibcore (npm)
- Jun 16, 2025
Malware in graphlibcore
1 compromised version
- Jun 16, 2025
Malicious code in pxsceneui-example-02 (npm)
3 compromised versions
- Jun 16, 2025
Malicious code in kenzup-react-native-rsa-native (npm)
1 compromised version
- Jun 16, 2025
Malicious code in azure-pipeline-filter (npm)
1 compromised version
- Jun 16, 2025
Malicious code in calculator-sse (npm)
- Jun 16, 2025
Malicious code in chii-aungpao (npm)
- Jun 16, 2025
Malicious code in boost-chii (npm)
- Jun 16, 2025
Malware in chii-aungpao
1 compromised version
- Jun 16, 2025
Malware in boost-chii
1 compromised version
- Jun 16, 2025
Malware in third-party-dep-b
1 compromised version
Page 6279 of 7,293