Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- May 2, 2025
Malicious code in fiddlesticks (npm)
1 compromised version
- May 2, 2025
Malicious code in bffhfuruhejfhdj (npm)
9 compromised versions
- May 2, 2025
Malware in smart-wallet-permissions
1 compromised version
- May 2, 2025
Malware in swap-subgraph
1 compromised version
- May 2, 2025
Malware in fiddlesticks
1 compromised version
- May 2, 2025
Malware in passkeys-integration
1 compromised version
- May 2, 2025
Malware in sxg-playground
1 compromised version
- May 2, 2025
Malware in twewewewest6
1 compromised version
- May 2, 2025
Malware in bffhfuruhejfhdj
1 compromised version
- May 2, 2025
Malware in wasitestforeducation
1 compromised version
- May 2, 2025
Malware in example-advanced
1 compromised version
- May 2, 2025
Malware in appqos-client
1 compromised version
- May 2, 2025
Malware in continue-docs
1 compromised version
- May 2, 2025
Malware in ad-language-monitor
1 compromised version
- May 2, 2025
Malware in hosted-wallet-page
1 compromised version
- May 2, 2025
Malware in moonpay-widget
1 compromised version
- May 2, 2025
Malware in safe-modules
1 compromised version
- May 2, 2025
Malware in drift-v1-cli
1 compromised version
- May 2, 2025
Malware in web3-trade
1 compromised version
- May 2, 2025
Malware in stablecoin-aptos
1 compromised version
- May 2, 2025
Malicious code in selfbot.js-v13 (npm)
- May 2, 2025
Malware in selfbot.js-v13
1 compromised version
- May 2, 2025
Malicious code in discord-json-parser (npm)
- May 2, 2025
Malware in discord-json-parser
1 compromised version
- May 2, 2025
Malware in 32red-checkout
1 compromised version
- May 2, 2025
Malware in 32red-api-client
1 compromised version
- May 2, 2025
Malware in 32red-connect
1 compromised version
- May 2, 2025
Malware in 32red-api
1 compromised version
- May 2, 2025
Malware in 32red-analytics
1 compromised version
- May 2, 2025
Malware in 32red-auth
1 compromised version
- May 2, 2025
Malware in 32red-cloud
1 compromised version
- May 2, 2025
Malware in 32red-admin
1 compromised version
- May 2, 2025
Malware in 32red-cache
1 compromised version
- May 2, 2025
Malware in 32red-database
1 compromised version
- May 2, 2025
Malware in planweb-core-ui
1 compromised version
- May 2, 2025
Malicious code in vanjavajs (npm)
3 compromised versions
- May 2, 2025
Malware in vanjavajs
1 compromised version
- May 2, 2025
Malicious code in socket-event-trigger (npm)
- May 2, 2025
Malware in socket-event-trigger
1 compromised version
- May 2, 2025
Malicious code in serverlog-dispatch (npm)
- May 2, 2025
Malicious code in mongo-errorlog (npm)
- May 2, 2025
Malware in mongo-errorlog
1 compromised version
- May 2, 2025
Malware in serverlog-dispatch
1 compromised version
- May 2, 2025
Malicious code in vite-plugin-tools (npm)
- May 2, 2025
Malicious code in next-log-patcher (npm)
- May 2, 2025
Malware in vite-plugin-tools
1 compromised version
- May 2, 2025
Malware in next-log-patcher
1 compromised version
- May 1, 2025
Malicious code in lezer-snowsql (npm)
17 compromised versions
- May 1, 2025
Malicious code in meridian-web-sdk-assets (npm)
1 compromised version
- May 1, 2025
Malicious code in minicom-support-client (npm)
1 compromised version
Page 6333 of 7,293