Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- May 15, 2025
Malware in pcln-popver
1 compromised version
- May 15, 2025
Malware in firefox-devtools
1 compromised version
- May 15, 2025
Malware in yandex-int
1 compromised version
- May 15, 2025
Malware in wix-pilot
1 compromised version
- May 15, 2025
Malware in wcc-connector
1 compromised version
- May 15, 2025
Malware in rushstack
1 compromised version
- May 15, 2025
Malware in lululemon
1 compromised version
- May 15, 2025
Malware in mozilla-protocol
1 compromised version
- May 15, 2025
Malware in airtable-blocks-internal
1 compromised version
- May 15, 2025
Malware in att-bit
1 compromised version
- May 15, 2025
Malicious code in helvetia-base-patterns (npm)
4 compromised versions
- May 15, 2025
Malicious code in @hotmart-org-ca/cosmos-tokens (npm)
- May 15, 2025
Malicious code in @hotmart-org-ca/cosmos (npm)
- May 15, 2025
Malware in helvetia-base-patterns
1 compromised version
- May 15, 2025
Malware in @hotmart-org-ca/cosmos
1 compromised version
- May 15, 2025
Malware in @hotmart-org-ca/cosmos-tokens
1 compromised version
- May 15, 2025
Malicious code in old-react-chat (npm)
1 compromised version
- May 15, 2025
Malware in old-react-chat
1 compromised version
- May 15, 2025
Malware in payouts-banking-info
1 compromised version
- May 15, 2025
Malware in safe-react-components
1 compromised version
- May 15, 2025
Malware in babel-preset-app
1 compromised version
- May 15, 2025
Malware in safe-apps-react-sdk
1 compromised version
- May 15, 2025
Malicious code in this-is-test-module (npm)
1 compromised version
- May 15, 2025
Malicious code in testqwee57985 (npm)
- May 15, 2025
Malware in testqwee57985
1 compromised version
- May 15, 2025
Malware in next-refresh-token
1 compromised version
- May 15, 2025
Malware in facetec-browser-sdk
1 compromised version
- May 15, 2025
Malicious code in unipig (npm)
- May 15, 2025
Malicious code in defipulse-adapters (npm)
- May 15, 2025
Malicious code in auction2keeper (npm)
- May 15, 2025
Malware in unipig
1 compromised version
- May 15, 2025
Malware in defipulse-adapters
1 compromised version
- May 15, 2025
Malware in auction2keeper
1 compromised version
- May 15, 2025
Malware in v2-foundry
1 compromised version
- May 15, 2025
Malware in unisocks
1 compromised version
- May 15, 2025
Malware in crypto-buddies
1 compromised version
- May 15, 2025
Malicious code in react-native-plugin-ms-adal (npm)
- May 15, 2025
Malicious code in passport-thecity (npm)
- May 15, 2025
Malicious code in opensource-marketplace (npm)
- May 15, 2025
Malicious code in openidconnect.net (npm)
- May 15, 2025
Malicious code in my-worker-with-router (npm)
- May 15, 2025
Malicious code in guardian-advanced-example (npm)
- May 15, 2025
Malicious code in custom-social-connections (npm)
- May 15, 2025
Malicious code in auth0-guardian-management-client (npm)
- May 15, 2025
Malicious code in auth0-authz (npm)
- May 15, 2025
Malicious code in ai_challenge (npm)
- May 15, 2025
Malicious code in aads-blog (npm)
- May 15, 2025
Malware in custom-social-connections
1 compromised version
- May 15, 2025
Malware in my-worker-with-router
1 compromised version
- May 15, 2025
Malware in auth0-authz
1 compromised version
Page 6322 of 7,293