Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Apr 17, 2025
Malicious code in fatfingers-hahayeet2 (npm)
- Apr 17, 2025
Malicious code in fatfingers-hahayeet (npm)
- Apr 17, 2025
Malware in fatfingers-hahayeet3333
1 compromised version
- Apr 17, 2025
Malware in fatfingers-hahayeet
1 compromised version
- Apr 17, 2025
Malware in fatfingers-hellooo
1 compromised version
- Apr 17, 2025
Malware in fatfingers-hello
1 compromised version
- Apr 17, 2025
Malware in fatfingers-hahayeet2
1 compromised version
- Apr 17, 2025
Malware in fatfingers-hahayeet33
1 compromised version
- Apr 17, 2025
Malware in fatfingers-helloo
1 compromised version
- Apr 17, 2025
Malware in fatfingers-hahayeet333
1 compromised version
- Apr 17, 2025
Malware in fatfingers-hahayeet3
1 compromised version
- Apr 17, 2025
Malware in kernelcon-bad-packagexp
1 compromised version
- Apr 17, 2025
Malicious code in ink-web-app (npm)
34 compromised versions
- Apr 17, 2025
Malicious code in featureapp-service (npm)
29 compromised versions
- Apr 17, 2025
Malicious code in dc-comments-beta-dropin (npm)
106 compromised versions
- Apr 17, 2025
Malicious code in airbnb-header (npm)
107 compromised versions
- Apr 17, 2025
Malicious code in airbnb-embed-frame (npm)
108 compromised versions
- Apr 17, 2025
Malicious code in airbnb-datepickeroptions (npm)
111 compromised versions
- Apr 17, 2025
Malware in airbnb-header
1 compromised version
- Apr 17, 2025
Malware in featureapp-service
1 compromised version
- Apr 17, 2025
Malware in airbnb-embed-frame
1 compromised version
- Apr 17, 2025
Malware in airbnb-datepickeroptions
1 compromised version
- Apr 17, 2025
Malware in ink-web-app
1 compromised version
- Apr 17, 2025
Malware in dc-comments-beta-dropin
1 compromised version
- Apr 17, 2025
Malicious code in dc-genai-dropin (npm)
112 compromised versions
- Apr 17, 2025
Malware in dc-genai-dropin
1 compromised version
- Apr 17, 2025
Malicious code in zkevm-rom (npm)
1 compromised version
- Apr 17, 2025
Malicious code in @zkasm/zkevm-rom (npm)
1 compromised version
- Apr 17, 2025
Malicious code in @harvest-finance/harvest-strategy-arbitrum (npm)
2 compromised versions
- Apr 17, 2025
Malware in eslint-config-mytonwallet
1 compromised version
- Apr 17, 2025
Malware in daos.fun
1 compromised version
- Apr 17, 2025
Malware in @harvest-finance/harvest-strategy-polygon
1 compromised version
- Apr 17, 2025
Malware in @zkasm/zkevm-rom
1 compromised version
- Apr 17, 2025
Malware in mtw-capacitor-usb-hid
1 compromised version
- Apr 17, 2025
Malware in r5-zknet-wallet
1 compromised version
- Apr 17, 2025
Malware in @oldzeppelin/contract
1 compromised version
- Apr 17, 2025
Malware in native-bottom-sheet
1 compromised version
- Apr 17, 2025
Malware in zkevm-rom
1 compromised version
- Apr 17, 2025
Malware in @harvest-finance/harvest-strategy-arbitrum
1 compromised version
- Apr 17, 2025
Malicious code in zkevm-commonjs (npm)
1 compromised version
- Apr 17, 2025
Malicious code in ton-evm-bridge (npm)
1 compromised version
- Apr 17, 2025
Malicious code in eigenlayer-middleware (npm)
1 compromised version
- Apr 17, 2025
Malicious code in eco-solver (npm)
3 compromised versions
- Apr 17, 2025
Malware in ton-evm-bridge
1 compromised version
- Apr 17, 2025
Malware in eco-solver
1 compromised version
- Apr 17, 2025
Malware in eigenlayer-middleware
1 compromised version
- Apr 17, 2025
Malware in zkevm-commonjs
1 compromised version
- Apr 17, 2025
Malware in blobstream-contracts
1 compromised version
- Apr 17, 2025
Malware in nextmvc3primary
1 compromised version
- Apr 17, 2025
Malicious code in talsec-react-native-security-plugin (npm)
1 compromised version
Page 6343 of 7,293