Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Mar 14, 2025
Malicious code in swing-log (npm)
- Mar 14, 2025
Malware in swing-log
1 compromised version
- Mar 14, 2025
Malicious code in node-key-lister (npm)
- Mar 14, 2025
Malicious code in key-lister (npm)
- Mar 14, 2025
Malware in node-key-lister
1 compromised version
- Mar 14, 2025
Malware in key-lister
1 compromised version
- Mar 14, 2025
Malicious code in snore-log (npm)
- Mar 14, 2025
Malicious code in resolve-configuration (npm)
- Mar 14, 2025
Malicious code in dev-debugger-vite (npm)
- Mar 14, 2025
Malicious code in core-pino (npm)
- Mar 14, 2025
Malware in resolve-configuration
1 compromised version
- Mar 14, 2025
Malware in dev-debugger-vite
1 compromised version
- Mar 14, 2025
Malware in snore-log
1 compromised version
- Mar 14, 2025
Malware in core-pino
1 compromised version
- Mar 14, 2025
Malicious code in transaction-generator (npm)
- Mar 14, 2025
Malware in transaction-generator
1 compromised version
- Mar 14, 2025
Malicious code in vue-plugin-rely2 (npm)
- Mar 14, 2025
Malicious code in vue-plugin-rely1 (npm)
- Mar 14, 2025
Malicious code in newland-digitization-ui (npm)
- Mar 14, 2025
Malicious code in newland-component-test (npm)
- Mar 14, 2025
Malicious code in newland-component (npm)
- Mar 14, 2025
Malicious code in dingpengtest-ui (npm)
- Mar 14, 2025
Malicious code in dingpeng-ui (npm)
- Mar 14, 2025
Malware in dingpeng-ui
1 compromised version
- Mar 14, 2025
Malware in vue-plugin-rely2
1 compromised version
- Mar 14, 2025
Malware in dingpengtest-ui
1 compromised version
- Mar 14, 2025
Malware in newland-component-test
1 compromised version
- Mar 14, 2025
Malware in newland-component
1 compromised version
- Mar 14, 2025
Malware in vue-plugin-rely1
1 compromised version
- Mar 14, 2025
Malware in newland-digitization-ui
1 compromised version
- Mar 14, 2025
Malicious code in ding123123131 (npm)
- Mar 14, 2025
Malware in ding123123131
1 compromised version
- Mar 14, 2025
Malware in doitoml
1 compromised version
- Mar 14, 2025
Malicious code in spark-botkit-servicenow (npm)
1 compromised version
- Mar 14, 2025
Malware in spark-botkit-servicenow
1 compromised version
- Mar 14, 2025
Malicious code in winston-js (npm)
- Mar 14, 2025
Malicious code in rekilog (npm)
- Mar 14, 2025
Malicious code in react-rekilog (npm)
- Mar 14, 2025
Malware in rekilog
1 compromised version
- Mar 14, 2025
Malware in react-rekilog
1 compromised version
- Mar 14, 2025
Malware in winston-js
1 compromised version
- Mar 14, 2025
Malicious code in cclr-huge-ui (npm)
3 compromised versions
- Mar 14, 2025
Malicious code in ccl-utilities (npm)
1 compromised version
- Mar 14, 2025
Malware in ccl-utilities
1 compromised version
- Mar 14, 2025
Malware in cclr-huge-ui
1 compromised version
- Mar 14, 2025
Malicious code in build-toolchain (npm)
- Mar 14, 2025
Malicious code in app-bridge-next (npm)
- Mar 14, 2025
Malicious code in @sp4b-dev/test-utils (npm)
- Mar 14, 2025
Malware in app-bridge-next
1 compromised version
- Mar 14, 2025
Malware in @sp4b-dev/test-utils
1 compromised version
Page 6372 of 7,293