Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- May 21, 2025
Malware in save-me-pls
1 compromised version
- May 21, 2025
Malicious code in happy-dl (npm)
- May 21, 2025
Malware in happy-dl
1 compromised version
- May 21, 2025
Malicious code in human-readable-time-formatter (npm)
- May 21, 2025
Malware in human-readable-time-formatter
1 compromised version
- May 21, 2025
Malicious code in system-v11 (npm)
- May 21, 2025
Malware in system-v11
1 compromised version
- May 21, 2025
Malicious code in modules-dmall-discord.js (npm)
- May 21, 2025
Malicious code in module-dmall-discord.js (npm)
- May 21, 2025
Malicious code in erelaaaaa.js (npm)
- May 21, 2025
Malicious code in biggy-deezer (npm)
- May 21, 2025
Malware in module-dmall-discord.js
1 compromised version
- May 21, 2025
Malware in erelaaaaa.js
1 compromised version
- May 21, 2025
Malware in biggy-deezer
1 compromised version
- May 21, 2025
Malware in modules-dmall-discord.js
1 compromised version
- May 21, 2025
Malicious code in keypair-utilsee (npm)
3 compromised versions
- May 21, 2025
Malware in keypair-utilsee
1 compromised version
- May 21, 2025
Malicious code in web3ether.js (npm)
- May 21, 2025
Malicious code in sdkss (npm)
- May 21, 2025
Malicious code in dexfile.js (npm)
- May 21, 2025
Malicious code in chains.web3 (npm)
- May 21, 2025
Malware in web3ether.js
1 compromised version
- May 21, 2025
Malware in sdkss
1 compromised version
- May 21, 2025
Malware in dexfile.js
1 compromised version
- May 21, 2025
Malware in chains.web3
1 compromised version
- May 21, 2025
Malware in earthdata-search
1 compromised version
- May 21, 2025
Malicious code in create-qr-core (npm)
- May 21, 2025
Malware in create-qr-core
1 compromised version
- May 21, 2025
Malicious code in ggeiekkepbwedvcmerki (npm)
23 compromised versions
- May 21, 2025
Malware in ggeiekkepbwedvcmerki
1 compromised version
- May 21, 2025
Malicious code in karansinghshergill (npm)
5 compromised versions
- May 21, 2025
Malware in karansinghshergill
1 compromised version
- May 21, 2025
Malicious code in spite (npm)
- May 21, 2025
Malicious code in scarce (npm)
- May 21, 2025
Malicious code in neodium (npm)
- May 21, 2025
Malicious code in envjsc (npm)
- May 21, 2025
Malware in scarce
1 compromised version
- May 21, 2025
Malware in spite
1 compromised version
- May 21, 2025
Malware in neodium
1 compromised version
- May 21, 2025
Malware in envjsc
1 compromised version
- May 21, 2025
Malicious code in string-multiutils (npm)
2 compromised versions
- May 21, 2025
Malware in string-multiutils
1 compromised version
- May 21, 2025
Malicious code in com.meta.xr.sdk.avatars.sample.assets (npm)
- May 21, 2025
Malicious code in br2s-ui-common-utils-02 (npm)
11 compromised versions
- May 21, 2025
Malware in frau-hoster
1 compromised version
- May 21, 2025
Malware in com.meta.xr.sdk.avatars.sample.assets
1 compromised version
- May 21, 2025
Malware in br2s-ui-common-utils-02
1 compromised version
- May 21, 2025
Malicious code in graphorithm (npm)
- May 21, 2025
Malware in graphorithm
1 compromised version
- May 21, 2025
Malicious code in gatsby-mars-pet-parent-journey--server (npm)
Page 6312 of 7,293