Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Mar 5, 2025
Malware in edubrite
1 compromised version
- Mar 5, 2025
Malware in fluentui-repo
1 compromised version
- Mar 5, 2025
Malware in archon7
1 compromised version
- Mar 5, 2025
Malware in archon4
1 compromised version
- Mar 5, 2025
Malware in archon3
1 compromised version
- Mar 5, 2025
Malicious code in idme-component-utilities (npm)
1 compromised version
- Mar 5, 2025
Malicious code in api-discord.js-v14 (npm)
- Mar 5, 2025
Malware in api-discord.js-v14
1 compromised version
- Mar 5, 2025
Malicious code in internoapi-rota (npm)
- Mar 5, 2025
Malicious code in hookform-resolvers (npm)
- Mar 5, 2025
Malware in internoapi-rota
1 compromised version
- Mar 5, 2025
Malware in hookform-resolvers
1 compromised version
- Mar 5, 2025
Malicious code in vscode-ps1 (npm)
- Mar 5, 2025
Malicious code in totem-project-website (npm)
1 compromised version
- Mar 5, 2025
Malicious code in sdk-playground (npm)
- Mar 5, 2025
Malicious code in paymaster-bundler-examples (npm)
- Mar 5, 2025
Malicious code in ncw-eddsa-signing (npm)
1 compromised version
- Mar 5, 2025
Malicious code in jquery-suggestable (npm)
1 compromised version
- Mar 5, 2025
Malicious code in edx-monitoring-only (npm)
1 compromised version
- Mar 5, 2025
Malicious code in discord_quick2 (npm)
1 compromised version
- Mar 5, 2025
Malicious code in alexpavlov--jquery-suggestable (npm)
1 compromised version
- Mar 5, 2025
Malicious code in aave-v3-crosschain-listing-template (npm)
- Mar 5, 2025
Malware in edx-monitoring-only
1 compromised version
- Mar 5, 2025
Malware in paymaster-bundler-examples
1 compromised version
- Mar 5, 2025
Malware in sdk-playground
1 compromised version
- Mar 5, 2025
Malware in discord_quick2
1 compromised version
- Mar 5, 2025
Malware in jquery-suggestable
1 compromised version
- Mar 5, 2025
Malware in vscode-ps1
1 compromised version
- Mar 5, 2025
Malware in alexpavlov--jquery-suggestable
1 compromised version
- Mar 5, 2025
Malware in aave-v3-crosschain-listing-template
1 compromised version
- Mar 5, 2025
Malware in ncw-eddsa-signing
1 compromised version
- Mar 5, 2025
Malware in totem-project-website
1 compromised version
- Mar 5, 2025
Malicious code in test-hahahaha-rce3 (npm)
- Mar 5, 2025
Malicious code in test-hahahaha-rce2 (npm)
- Mar 5, 2025
Malicious code in test-hahahaha-rce1 (npm)
- Mar 5, 2025
Malicious code in test-hahahaha-rce (npm)
- Mar 5, 2025
Malware in test-hahahaha-rce3
1 compromised version
- Mar 5, 2025
Malware in test-hahahaha-rce2
1 compromised version
- Mar 5, 2025
Malware in test-hahahaha-rce1
1 compromised version
- Mar 5, 2025
Malware in ing-open-banking-cli-js
1 compromised version
- Mar 5, 2025
Malware in test-hahahaha-rce
1 compromised version
- Mar 5, 2025
Malicious code in @idme-components/component-utilities (npm)
4 compromised versions
- Mar 5, 2025
Malicious code in certifications (PyPI)
1 compromised version
- Mar 5, 2025
Malicious code in dexter-server (npm)
1 compromised version
- Mar 5, 2025
Malicious code in migrate-npm-registry (npm)
1 compromised version
- Mar 5, 2025
Malicious code in sdxcode1 (npm)
1 compromised version
- Mar 5, 2025
Malicious code in nmp-frontend-libraries (npm)
3 compromised versions
- Mar 5, 2025
Malicious code in d4rk0nm3 (npm)
1 compromised version
- Mar 4, 2025
Malicious code in adminauthserv-paypal (npm)
2 compromised versions
- Mar 4, 2025
Malicious code in symphony-data-map (npm)
3 compromised versions
Page 6383 of 7,293