Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Apr 23, 2025
Malicious code in tesla-design-system (npm)
1 compromised version
- Apr 23, 2025
Malicious code in tax-return-breakup (npm)
3 compromised versions
- Apr 23, 2025
Malicious code in sticos.oppslag.web (npm)
1 compromised version
- Apr 23, 2025
Malicious code in startpeople-website (npm)
1 compromised version
- Apr 23, 2025
Malicious code in sas-pseudol10n4js (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in ruba-clearpass-api (npm)
1 compromised version
- Apr 23, 2025
Malicious code in pdf-to-office (npm)
4 compromised versions
- Apr 23, 2025
Malicious code in packageblueimp-file-upload (npm)
1 compromised version
- Apr 23, 2025
Malicious code in onemoretest9 (npm)
1 compromised version
- Apr 23, 2025
Malicious code in o2_console_front (npm)
1 compromised version
- Apr 23, 2025
Malicious code in npm-test-lowerx3 (npm)
1 compromised version
- Apr 23, 2025
Malicious code in members.cdbaby.com (npm)
1 compromised version
- Apr 23, 2025
Malicious code in malwaretestingg (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in liquity2 (npm)
1 compromised version
- Apr 23, 2025
Malicious code in jobaline (npm)
1 compromised version
- Apr 23, 2025
Malicious code in jios (npm)
1 compromised version
- Apr 23, 2025
Malicious code in https-agen-chii (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in gemini-proxy-panel (npm)
1 compromised version
- Apr 23, 2025
Malicious code in fcw-dashboard-components (npm)
16 compromised versions
- Apr 23, 2025
Malicious code in eslint-config-bfx-ui (npm)
1 compromised version
- Apr 23, 2025
Malicious code in editor-inscriptions (npm)
1 compromised version
- Apr 23, 2025
Malicious code in dhruva_dashboard (npm)
1 compromised version
- Apr 23, 2025
Malicious code in code-nasa-gov (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in chii-public (npm)
1 compromised version
- Apr 23, 2025
Malicious code in careers.klaviyo.com (npm)
1 compromised version
- Apr 23, 2025
Malicious code in bespoke-es (npm)
1 compromised version
- Apr 23, 2025
Malicious code in audio_helper_utils (npm)
5 compromised versions
- Apr 23, 2025
Malicious code in anton-uploader (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in angular2-tesla-common-1 (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in afterlogic-aurora-platform (npm)
1 compromised version
- Apr 23, 2025
Malicious code in 0xpolygonhermez (npm)
1 compromised version
- Apr 23, 2025
Malicious code in @sporta-technology/sample-npm-package (npm)
1 compromised version
- Apr 23, 2025
Malicious code in @sporta-technology/rn-components.text-input (npm)
1 compromised version
- Apr 23, 2025
Malicious code in @sporta-technology/rn-components.appbar (npm)
1 compromised version
- Apr 23, 2025
Malicious code in @sporta-technology/dream11_msd.tab-layout (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/dream11_msd.card (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.typography (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.tooltip (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.toggle-button (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.toggle (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.timeline (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.text-link (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.text-button (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.text-area (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.tags.tags-status (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.tags.tags-counter (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.tags.tags (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.tabs (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.table-cells.tc-tags-status (npm)
2 compromised versions
- Apr 23, 2025
Malicious code in @sporta-technology/d11-web-components.table-cells.tc-icon-list (npm)
2 compromised versions
Page 6339 of 7,293