Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Jun 11, 2025
Malicious code in izat (npm)
1 compromised version
- Jun 11, 2025
Malicious code in error-ux-components (npm)
1 compromised version
- Jun 11, 2025
Malicious code in supersccan (npm)
- Jun 11, 2025
Malicious code in ods-core-v1 (npm)
- Jun 11, 2025
Malicious code in mh-swagger-api (npm)
- Jun 11, 2025
Malicious code in cockpit-header-icon-components (npm)
- Jun 11, 2025
Malicious code in ac-mvc-cid (npm)
- Jun 11, 2025
Malicious code in ac-ajax (npm)
- Jun 11, 2025
Malware in ac-mvc-data-provider
1 compromised version
- Jun 11, 2025
Malware in @velorum/browser-authenticator
1 compromised version
- Jun 11, 2025
Malware in supersccan
1 compromised version
- Jun 11, 2025
Malware in @yahoo-engadget/i13n
1 compromised version
- Jun 11, 2025
Malware in @portal-reporting/report-ui-templates
1 compromised version
- Jun 11, 2025
Malware in fallback-screen
1 compromised version
- Jun 11, 2025
Malware in ac-mvc-cid
1 compromised version
- Jun 11, 2025
Malware in cockpit-header-icon-components
1 compromised version
- Jun 11, 2025
Malware in mh-swagger-api
1 compromised version
- Jun 11, 2025
Malware in ods-core-v1
1 compromised version
- Jun 11, 2025
Malware in ac-object
1 compromised version
- Jun 11, 2025
Malware in ac-ajax
1 compromised version
- Jun 11, 2025
Malicious code in ac-shared-instance (npm)
- Jun 11, 2025
Malware in ac-shared-instance
1 compromised version
- Jun 11, 2025
Malware in bu_account_js_sdk
1 compromised version
- Jun 11, 2025
Malware in lpgoffers-api-contract
1 compromised version
- Jun 11, 2025
Malicious code in thisisatestllll (npm)
1 compromised version
- Jun 11, 2025
Malware in sa-sdk-v5
1 compromised version
- Jun 11, 2025
Malware in thisisatestllll
1 compromised version
- Jun 10, 2025
Malicious code in win32str (PyPI)
2 compromised versions
- Jun 10, 2025
Malicious code in win32evtlogutil (PyPI)
1 compromised version
- Jun 10, 2025
Malicious code in win32evtlog (PyPI)
2 compromised versions
- Jun 10, 2025
Malicious code in package-resources (PyPI)
1 compromised version
- Jun 10, 2025
Malicious code in missing-module (PyPI)
1 compromised version
- Jun 10, 2025
Malicious code in gclient-eval (PyPI)
1 compromised version
- Jun 10, 2025
Malicious code in fb303-core (PyPI)
1 compromised version
- Jun 10, 2025
Malicious code in lichess-db (npm)
1 compromised version
- Jun 10, 2025
Malicious code in truth-loop-server (npm)
1 compromised version
- Jun 10, 2025
Malicious code in hello-gator (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/utils (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/toggle (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/tabs (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/switch (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/slider (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/separator (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/radio (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/overlays (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/menu (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/listbox (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/interactions (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/focus (npm)
1 compromised version
- Jun 10, 2025
Malicious code in @react-native-aria/disclosure (npm)
1 compromised version
Page 6283 of 7,293