Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Apr 17, 2025
Malware in talsec-react-native-security-plugin
1 compromised version
- Apr 17, 2025
Malware in tec-registry
1 compromised version
- Apr 17, 2025
Malicious code in juvare (npm)
1 compromised version
- Apr 17, 2025
Malware in juvare
1 compromised version
- Apr 17, 2025
Malicious code in transactions-generation (npm)
- Apr 17, 2025
Malware in transactions-generation
1 compromised version
- Apr 17, 2025
Malicious code in responsive-pitch-fx (npm)
- Apr 17, 2025
Malicious code in @x-mlbtv/client-utils (npm)
- Apr 17, 2025
Malicious code in @mlbtv-clients/isu (npm)
- Apr 17, 2025
Malicious code in @bane-mlb/less-styles (npm)
- Apr 17, 2025
Malware in responsive-pitch-fx
1 compromised version
- Apr 17, 2025
Malware in @bane-mlb/less-styles
1 compromised version
- Apr 17, 2025
Malware in @mlbtv-clients/isu
1 compromised version
- Apr 17, 2025
Malware in @x-mlbtv/client-utils
1 compromised version
- Apr 17, 2025
Malicious code in ezidox (npm)
- Apr 17, 2025
Malicious code in bespoke-it (npm)
1 compromised version
- Apr 17, 2025
Malware in redis_mktg
1 compromised version
- Apr 17, 2025
Malware in bespoke-it
1 compromised version
- Apr 17, 2025
Malware in ezidox
1 compromised version
- Apr 16, 2025
Malicious code in @csds-web-components/csds-iconset (npm)
- Apr 16, 2025
Malicious code in @csds-web-components/csds-icon (npm)
- Apr 16, 2025
Malicious code in @csds-web-components/csds-container (npm)
- Apr 16, 2025
Malicious code in @cat-wc/utilities (npm)
1 compromised version
- Apr 16, 2025
Malware in @csds-web-components/csds-icon
1 compromised version
- Apr 16, 2025
Withdrawn Advisory: Malware in @cat-wc/utilities
1 compromised version
- Apr 16, 2025
Malware in @csds-web-components/csds-iconset
1 compromised version
- Apr 16, 2025
Malware in @csds-web-components/csds-container
1 compromised version
- Apr 16, 2025
Malicious code in verif8 (npm)
1 compromised version
- Apr 16, 2025
Malicious code in multichannelsender (npm)
2 compromised versions
- Apr 16, 2025
Malicious code in element-ui-locale-id (npm)
- Apr 16, 2025
Malicious code in element-ui-locale-en (npm)
- Apr 16, 2025
Malware in element-ui-locale-id
1 compromised version
- Apr 16, 2025
Malware in multichannelsender
1 compromised version
- Apr 16, 2025
Malware in element-ui-locale-en
1 compromised version
- Apr 16, 2025
Malware in verif8
1 compromised version
- Apr 15, 2025
Malicious code in glog-parser (npm)
- Apr 15, 2025
Malware in glog-parser
1 compromised version
- Apr 15, 2025
Malware in sysaid-infra-analytics
1 compromised version
- Apr 15, 2025
Malicious code in @talentai/carbon-addons-talent-ai (npm)
- Apr 15, 2025
Malware in @talentai/carbon-addons-talent-ai
1 compromised version
- Apr 15, 2025
Malicious code in flex-plugins (npm)
- Apr 15, 2025
Malicious code in flex-key (npm)
- Apr 15, 2025
Malware in flex-key
1 compromised version
- Apr 15, 2025
Malware in flex-plugins
1 compromised version
- Apr 12, 2025
Malicious code in colorona (PyPI)
1 compromised version
- Apr 11, 2025
Malicious code in empty-validator-plugin (npm)
1 compromised version
- Apr 11, 2025
Malware in empty-validator-plugin
1 compromised version
- Apr 10, 2025
Malicious code in colorina (PyPI)
11 compromised versions
- Apr 9, 2025
Malicious code in @medialink-ml/yuzu-widget (npm)
- Apr 9, 2025
Malware in @medialink-ml/yuzu-widget
1 compromised version
Page 6344 of 7,293