Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Mar 2, 2025
Malicious code in metrics-aggregator (npm)
1 compromised version
- Mar 2, 2025
Malicious code in ad-creative-preview (npm)
1 compromised version
- Mar 2, 2025
Malicious code in ocular-monorepo (npm)
1 compromised version
- Mar 2, 2025
Malicious code in react-native-windows-repo (npm)
4 compromised versions
- Mar 2, 2025
Malicious code in sip.js-v2 (npm)
3 compromised versions
- Mar 2, 2025
Malicious code in ringcentral-web-phone-v2 (npm)
4 compromised versions
- Mar 1, 2025
Malicious code in com.google.xr.windowmirror (npm)
2 compromised versions
- Mar 1, 2025
Malicious code in pinterest-api-quickstart (npm)
1 compromised version
- Mar 1, 2025
Malicious code in skyflowelements (npm)
1 compromised version
- Mar 1, 2025
Malicious code in okta-sdk-php-openapi (npm)
1 compromised version
- Mar 1, 2025
Malicious code in azps (npm)
1 compromised version
- Mar 1, 2025
Malicious code in secureshield4 (npm)
3 compromised versions
- Mar 1, 2025
Malicious code in nanovest-portal (npm)
1 compromised version
- Mar 1, 2025
Malicious code in azure-sdk-tools (npm)
1 compromised version
- Mar 1, 2025
Malicious code in piedefender (PyPI)
1 compromised version
- Mar 1, 2025
Malicious code in pydefender (PyPI)
1 compromised version
- Mar 1, 2025
Malicious code in doitoml (npm)
1 compromised version
- Mar 1, 2025
Malicious code in local_editor_top (npm)
1 compromised version
- Mar 1, 2025
Malicious code in iff-root (npm)
1 compromised version
- Mar 1, 2025
Malicious code in react-component-usage (npm)
1 compromised version
- Mar 1, 2025
Malicious code in onyx-ssi-sdk-examples (npm)
1 compromised version
- Mar 1, 2025
Malicious code in figma-plugins-and-widgets (npm)
1 compromised version
- Mar 1, 2025
Malicious code in battleships-player (npm)
1 compromised version
- Mar 1, 2025
Malicious code in esm-appdynamics-grafana-react-datasource (npm)
1 compromised version
- Mar 1, 2025
Malicious code in ark-boostrap (npm)
1 compromised version
- Feb 28, 2025
Malicious code in morganstanley.github.io (npm)
1 compromised version
- Feb 28, 2025
Malicious code in eslint-plugin-externalincludes (npm)
2 compromised versions
- Feb 28, 2025
Malicious code in tablegen (npm)
1 compromised version
- Feb 28, 2025
Malicious code in synapse-contracts (npm)
1 compromised version
- Feb 28, 2025
Malicious code in webbundle-plugins (npm)
1 compromised version
- Feb 28, 2025
Malicious code in tfjs-backend-webgl (npm)
- Feb 28, 2025
Malicious code in tfjs-backend-cpu (npm)
1 compromised version
- Feb 28, 2025
Malicious code in rpsreadserv (npm)
- Feb 28, 2025
Malware in rpsreadserv
1 compromised version
- Feb 28, 2025
Malware in tfjs-backend-cpu
1 compromised version
- Feb 28, 2025
Malware in tfjs-backend-webgl
1 compromised version
- Feb 28, 2025
Malicious code in the-integrator (npm)
- Feb 28, 2025
Malicious code in pp-react-content-loader (npm)
10 compromised versions
- Feb 28, 2025
Malicious code in paypal-checkout-integration-backend-node (npm)
- Feb 28, 2025
Malicious code in mep-widget-components (npm)
- Feb 28, 2025
Malicious code in mep-who (npm)
- Feb 28, 2025
Malicious code in mep-ul-utils (npm)
- Feb 28, 2025
Malicious code in keymakerclientapi (npm)
- Feb 28, 2025
Malicious code in jaws-node (npm)
- Feb 28, 2025
Malicious code in findomestic-ui-style (npm)
- Feb 28, 2025
Malicious code in findomestic-ui-components (npm)
6 compromised versions
- Feb 28, 2025
Malicious code in fb-components-lib (npm)
- Feb 28, 2025
Malicious code in cmp-ocr-liveness-acquisition (npm)
- Feb 28, 2025
Malicious code in cmp-dossier-tracking (npm)
- Feb 28, 2025
Malicious code in actsearchserv (npm)
Page 6396 of 7,293