Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Apr 2, 2025
Malware in tap-hook
1 compromised version
- Apr 2, 2025
Malware in niji-react-prettybytes
1 compromised version
- Apr 2, 2025
Malware in meeting-card-component
1 compromised version
- Apr 2, 2025
Malware in new-items-card-component
1 compromised version
- Apr 2, 2025
Malware in webhooks-contacts-app
1 compromised version
- Apr 2, 2025
Malicious code in servicecore-response-handler (npm)
109 compromised versions
- Apr 2, 2025
Malicious code in nemo-dast-plugin (npm)
124 compromised versions
- Apr 2, 2025
Malicious code in at-authorize-paypal (npm)
121 compromised versions
- Apr 2, 2025
Malicious code in airbnb-dls-web (npm)
- Apr 2, 2025
Malware in servicecore-response-handler
1 compromised version
- Apr 2, 2025
Malware in nemo-dast-plugin
1 compromised version
- Apr 2, 2025
Malware in at-authorize-paypal
1 compromised version
- Apr 2, 2025
Malware in airbnb-dls-web
1 compromised version
- Apr 2, 2025
Malicious code in mahesh.dojo (npm)
1 compromised version
- Apr 2, 2025
Malicious code in @nationalgeographicsociety/ngsui-core-react (npm)
2 compromised versions
- Apr 2, 2025
Malware in mahesh.dojo
1 compromised version
- Apr 2, 2025
Malware in @nationalgeographicsociety/ngsui-core-react
1 compromised version
- Apr 2, 2025
Malicious code in lts-patterns (npm)
2 compromised versions
- Apr 2, 2025
Malicious code in @nationalgeographicsociety/ngsui-header-auth-provider-next (npm)
2 compromised versions
- Apr 2, 2025
Malicious code in @nationalgeographicsociety/ngsui-addons-react (npm)
2 compromised versions
- Apr 2, 2025
Malware in @nationalgeographicsociety/ngsui-header
1 compromised version
- Apr 2, 2025
Malware in lts-patterns
1 compromised version
- Apr 2, 2025
Malware in @nationalgeographicsociety/ngsui-footer
1 compromised version
- Apr 2, 2025
Malware in @nationalgeographicsociety/ngsui-addons-react
1 compromised version
- Apr 2, 2025
Malware in @nationalgeographicsociety/ngsui-header-auth-provider-next
1 compromised version
- Apr 2, 2025
Malicious code in @piplabs/story-contracts (npm)
1 compromised version
- Apr 2, 2025
Malicious code in blobstream-contracts (npm)
1 compromised version
- Apr 1, 2025
Malicious code in tap-hook (npm)
1 compromised version
- Apr 1, 2025
Malicious code in keypair-utils (npm)
- Apr 1, 2025
Malware in keypair-utils
1 compromised version
- Apr 1, 2025
Malicious code in snyk-malware-poc (npm)
3 compromised versions
- Mar 31, 2025
Malicious code in sccket (PyPI)
1 compromised version
- Mar 31, 2025
Malicious code in runwifi (PyPI)
1 compromised version
- Mar 31, 2025
Malicious code in runningwifi (PyPI)
1 compromised version
- Mar 31, 2025
Malicious code in randomwifi (PyPI)
1 compromised version
- Mar 31, 2025
Malicious code in pocketnet (npm)
3 compromised versions
- Mar 31, 2025
Malicious code in yass_eal_abcdef_ssdsf_dsfsf (npm)
- Mar 31, 2025
Malicious code in saur-viseau-state-management (npm)
- Mar 31, 2025
Malicious code in saur-states-management (npm)
- Mar 31, 2025
Malicious code in saur-design-sys-web (npm)
- Mar 31, 2025
Malware in saur-viseau-state-management
1 compromised version
- Mar 31, 2025
Malware in saur-design-sys-web
1 compromised version
- Mar 31, 2025
Malware in yass_eal_abcdef_ssdsf_dsfsf
1 compromised version
- Mar 31, 2025
Malware in saur-states-management
1 compromised version
- Mar 31, 2025
Malicious code in @sas-dvr/ltjs-vav (npm)
2 compromised versions
- Mar 31, 2025
Malicious code in @sas-dvr/nova-crossorigin-auth (npm)
2 compromised versions
- Mar 31, 2025
Malicious code in @sas-dvr/ltjs-bird (npm)
2 compromised versions
- Mar 31, 2025
Malicious code in @sas-dvr/nova-graph (npm)
2 compromised versions
- Mar 31, 2025
Malicious code in @sas-dvr/ltjs-gtl (npm)
2 compromised versions
- Mar 31, 2025
Malicious code in ria-learninghub (npm)
2 compromised versions
Page 6352 of 7,293