Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Apr 2, 2025
Malware in @hongfangze/email
1 compromised version
- Apr 2, 2025
Malware in @hongfangze/string
1 compromised version
- Apr 2, 2025
Malware in @hongfangze/obtain
1 compromised version
- Apr 2, 2025
Malware in @hongfangze/simple-resource-server
1 compromised version
- Apr 2, 2025
Malware in @hongfangze/guid
1 compromised version
- Apr 2, 2025
Malware in @hongfangze/date
1 compromised version
- Apr 2, 2025
Malware in @hongfangze/array
1 compromised version
- Apr 2, 2025
Malware in @hongfangze/calc
1 compromised version
- Apr 2, 2025
Malware in @hongfangze/network
1 compromised version
- Apr 2, 2025
Malware in @hongfangze/concurrent
1 compromised version
- Apr 2, 2025
Malware in @hongfangze/computer
1 compromised version
- Apr 2, 2025
Malware in @hongfangze/office
1 compromised version
- Apr 2, 2025
Malicious code in ehackify-workshop (npm)
2 compromised versions
- Apr 2, 2025
Malicious code in ehackify-example-test (npm)
3 compromised versions
- Apr 2, 2025
Malicious code in @atulrv1day/unusedpackage (npm)
- Apr 2, 2025
Malware in ehackify-example-test
1 compromised version
- Apr 2, 2025
Malware in @atulrv1day/unusedpackage
1 compromised version
- Apr 2, 2025
Malware in ehackify-workshop
1 compromised version
- Apr 2, 2025
Malicious code in keybase-live-feed (npm)
- Apr 2, 2025
Malicious code in gaming-fe (npm)
- Apr 2, 2025
Malware in keybase-live-feed
1 compromised version
- Apr 2, 2025
Malware in gaming-fe
1 compromised version
- Apr 2, 2025
Malicious code in accountlifecycleserv (npm)
1 compromised version
- Apr 2, 2025
Malware in accountlifecycleserv
1 compromised version
- Apr 2, 2025
Malicious code in niji-react-utils (npm)
1 compromised version
- Apr 2, 2025
Malicious code in niji-react-textarea (npm)
1 compromised version
- Apr 2, 2025
Malicious code in niji-react-switch (npm)
1 compromised version
- Apr 2, 2025
Malicious code in niji-react-select (npm)
1 compromised version
- Apr 2, 2025
Malicious code in niji-react-prettybytes (npm)
1 compromised version
- Apr 2, 2025
Malicious code in niji-react-input (npm)
1 compromised version
- Apr 2, 2025
Malicious code in niji-react-icon (npm)
1 compromised version
- Apr 2, 2025
Malicious code in niji-react-collapsible (npm)
1 compromised version
- Apr 2, 2025
Malicious code in niji-react-alert (npm)
1 compromised version
- Apr 2, 2025
Malicious code in mocha-appscan-reporter (npm)
1 compromised version
- Apr 2, 2025
Malicious code in grunt-ci-suite (npm)
1 compromised version
- Apr 2, 2025
Malicious code in checkoutsellerplatserv (npm)
1 compromised version
- Apr 2, 2025
Malware in insights-card-component
1 compromised version
- Apr 2, 2025
Malware in niji-react-switch
1 compromised version
- Apr 2, 2025
Malware in niji-react-icon
1 compromised version
- Apr 2, 2025
Malware in calendar-card-component
1 compromised version
- Apr 2, 2025
Malware in @devstack-angular/jdai
1 compromised version
- Apr 2, 2025
Malware in niji-react-select
1 compromised version
- Apr 2, 2025
Malware in checkoutsellerplatserv
1 compromised version
- Apr 2, 2025
Malware in niji-react-utils
1 compromised version
- Apr 2, 2025
Malware in mocha-appscan-reporter
1 compromised version
- Apr 2, 2025
Malware in niji-react-input
1 compromised version
- Apr 2, 2025
Malware in grunt-ci-suite
1 compromised version
- Apr 2, 2025
Malware in niji-react-collapsible
1 compromised version
- Apr 2, 2025
Malware in niji-react-alert
1 compromised version
- Apr 2, 2025
Malware in niji-react-textarea
1 compromised version
Page 6351 of 7,293