Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,629 total · sorted newest first- Mar 5, 2025
Malicious code in swerve-ui (npm)
2 compromised versions
- Mar 5, 2025
Malicious code in safe-events-service (npm)
- Mar 5, 2025
Malicious code in grafana-resources-exporter-app (npm)
1 compromised version
- Mar 5, 2025
Malicious code in base-plugin (npm)
4 compromised versions
- Mar 5, 2025
Malicious code in async-query-data (npm)
2 compromised versions
- Mar 5, 2025
Malicious code in adyen-web-main (npm)
1 compromised version
- Mar 5, 2025
Malware in atpw-reactive-form
1 compromised version
- Mar 5, 2025
Malware in rdocs-light
1 compromised version
- Mar 5, 2025
Malware in adyenaddon
1 compromised version
- Mar 5, 2025
Malware in grafana-metricsdrilldown-app
1 compromised version
- Mar 5, 2025
Malware in learning-kotlin
1 compromised version
- Mar 5, 2025
Malware in adyen-web-main
1 compromised version
- Mar 5, 2025
Malware in async-query-data
1 compromised version
- Mar 5, 2025
Malware in safe-client-gateway
1 compromised version
- Mar 5, 2025
Malware in react-native-survicate
1 compromised version
- Mar 5, 2025
Malware in safe-events-service
1 compromised version
- Mar 5, 2025
Malware in base-plugin
1 compromised version
- Mar 5, 2025
Malware in grafana-resources-exporter-app
1 compromised version
- Mar 5, 2025
Malware in swerve-ui
1 compromised version
- Mar 5, 2025
Malware in metrics-aggregator
1 compromised version
- Mar 5, 2025
Malware in timify-packager
1 compromised version
- Mar 5, 2025
Malicious code in node-unzip (npm)
2 compromised versions
- Mar 5, 2025
Malicious code in makerspace-cpx-intro (npm)
- Mar 5, 2025
Malicious code in innersource-sig (npm)
- Mar 5, 2025
Malicious code in fdc3-web-monorepo (npm)
- Mar 5, 2025
Malicious code in existdb-node (npm)
- Mar 5, 2025
Malicious code in ccf-identity (npm)
- Mar 5, 2025
Malware in existdb-node
1 compromised version
- Mar 5, 2025
Malware in package-inherit
1 compromised version
- Mar 5, 2025
Malware in azps
1 compromised version
- Mar 5, 2025
Malware in iff-root
1 compromised version
- Mar 5, 2025
Malware in amagi-kanban
1 compromised version
- Mar 5, 2025
Malware in fdc3-web-monorepo
1 compromised version
- Mar 5, 2025
Malware in onyx-ssi-sdk-examples
1 compromised version
- Mar 5, 2025
Malware in azure_monitor_workbook_templates
1 compromised version
- Mar 5, 2025
Malware in innersource-sig
1 compromised version
- Mar 5, 2025
Malware in figma-plugins-and-widgets
1 compromised version
- Mar 5, 2025
Malware in battleships-player
1 compromised version
- Mar 5, 2025
Malware in react-component-usage
1 compromised version
- Mar 5, 2025
Malware in eslint-plugin-externalincludes
1 compromised version
- Mar 5, 2025
Malware in tablegen
1 compromised version
- Mar 5, 2025
Malware in esm-appdynamics-grafana-react-datasource
1 compromised version
- Mar 5, 2025
Malware in morganstanley.github.io
1 compromised version
- Mar 5, 2025
Malware in node-unzip
1 compromised version
- Mar 5, 2025
Malware in makerspace-cpx-intro
1 compromised version
- Mar 5, 2025
Malware in azure-sdk-tools
1 compromised version
- Mar 5, 2025
Malware in ccf-identity
1 compromised version
- Mar 5, 2025
Malware in archon5
1 compromised version
- Mar 5, 2025
Malware in my-archon
1 compromised version
- Mar 5, 2025
Malware in archon1
1 compromised version
Page 6382 of 7,293