Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- May 6, 2025
Malware in compiletest_rs
1 compromised version
- May 6, 2025
Malicious code in vue-highcharts-official (npm)
1 compromised version
- May 6, 2025
Malware in vue-highcharts-official
1 compromised version
- May 6, 2025
Malicious code in slimdx (npm)
1 compromised version
- May 6, 2025
Malware in slimdx
1 compromised version
- May 6, 2025
Malicious code in typescript-plugin-some-plugin (npm)
1 compromised version
- May 6, 2025
Malware in typescript-plugin-some-plugin
1 compromised version
- May 6, 2025
Malicious code in jest-coverage-merge (npm)
1 compromised version
- May 6, 2025
Malware in jest-coverage-merge
1 compromised version
- May 6, 2025
Malware in slf4j-api-js
1 compromised version
- May 6, 2025
Malicious code in cordova-plugin-permissions (npm)
1 compromised version
- May 6, 2025
Malware in cordova-plugin-permissions
1 compromised version
- May 6, 2025
Malicious code in istanbul-reporter-lcov (npm)
1 compromised version
- May 6, 2025
Malware in istanbul-reporter-lcov
1 compromised version
- May 6, 2025
Malicious code in beautifulsoup4 (npm)
1 compromised version
- May 6, 2025
Malware in beautifulsoup4
1 compromised version
- May 6, 2025
Malicious code in psalm (npm)
1 compromised version
- May 6, 2025
Malware in psalm
1 compromised version
- May 6, 2025
Malicious code in reactotron-mobx (npm)
1 compromised version
- May 6, 2025
Malware in reactotron-mobx
1 compromised version
- May 6, 2025
Malicious code in hungarian-algorithm (npm)
1 compromised version
- May 6, 2025
Malware in hungarian-algorithm
1 compromised version
- May 6, 2025
Malicious code in swagger2-postman2 (npm)
1 compromised version
- May 6, 2025
Malware in swagger2-postman2
1 compromised version
- May 6, 2025
Malicious code in flush-plugins (npm)
- May 6, 2025
Malware in flush-plugins
1 compromised version
- May 6, 2025
Malicious code in josson (npm)
1 compromised version
- May 6, 2025
Malware in josson
1 compromised version
- May 6, 2025
Malicious code in commons-net (npm)
1 compromised version
- May 6, 2025
Malware in commons-net
1 compromised version
- May 6, 2025
Malicious code in internal-company-api (npm)
- May 6, 2025
Malware in internal-company-api
1 compromised version
- May 6, 2025
Malicious code in babel-plugin-some-plugin (npm)
1 compromised version
- May 6, 2025
Malware in babel-plugin-some-plugin
1 compromised version
- May 6, 2025
Malicious code in vim-refactor (npm)
1 compromised version
- May 6, 2025
Malware in vim-refactor
1 compromised version
- May 6, 2025
Malicious code in vue-ssr-devtools (npm)
1 compromised version
- May 6, 2025
Malware in vue-ssr-devtools
1 compromised version
- May 6, 2025
Malicious code in opentk (npm)
1 compromised version
- May 6, 2025
Malware in opentk
1 compromised version
- May 6, 2025
Malicious code in your-published-package (npm)
1 compromised version
- May 6, 2025
Malware in your-published-package
1 compromised version
- May 6, 2025
Malicious code in dayjs-plugin-duration (npm)
1 compromised version
- May 6, 2025
Malware in dayjs-plugin-duration
1 compromised version
- May 6, 2025
Malicious code in platformio (npm)
1 compromised version
- May 6, 2025
Malware in platformio
1 compromised version
- May 6, 2025
Malicious code in jna (npm)
1 compromised version
- May 6, 2025
Malware in jna
1 compromised version
- May 6, 2025
Malicious code in jetty-quic (npm)
1 compromised version
- May 6, 2025
Malware in jetty-quic
1 compromised version
Page 6330 of 7,293