Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Feb 23, 2025
Malicious code in yxt-factor (npm)
1 compromised version
- Feb 23, 2025
Malicious code in @isimplelab/ng2-charts (npm)
1 compromised version
- Feb 23, 2025
Malicious code in tstfde54545 (npm)
1 compromised version
- Feb 23, 2025
Malicious code in testing098765 (npm)
1 compromised version
- Feb 23, 2025
Malicious code in sample-notes-application (npm)
1 compromised version
- Feb 23, 2025
Malicious code in fgrttry565be (npm)
1 compromised version
- Feb 23, 2025
Malicious code in com.adobe.cq.core.wcm.components.content (npm)
1 compromised version
- Feb 23, 2025
Malicious code in charts-e2e (npm)
1 compromised version
- Feb 23, 2025
Malicious code in 1password-sdk-examples (npm)
1 compromised version
- Feb 23, 2025
Malicious code in my-archon (npm)
1 compromised version
- Feb 23, 2025
Malicious code in dracoon (npm)
1 compromised version
- Feb 23, 2025
Malicious code in archon6 (npm)
1 compromised version
- Feb 23, 2025
Malicious code in archon4 (npm)
1 compromised version
- Feb 23, 2025
Malicious code in archon1 (npm)
1 compromised version
- Feb 23, 2025
Malicious code in honeybook-marketing-gatsby (npm)
1 compromised version
- Feb 23, 2025
Malicious code in gslack (npm)
1 compromised version
- Feb 23, 2025
Malicious code in flow-inflation-client (npm)
1 compromised version
- Feb 23, 2025
Malicious code in explore-assistant (npm)
1 compromised version
- Feb 23, 2025
Malicious code in bqtop (npm)
1 compromised version
- Feb 23, 2025
Malicious code in zooplus (npm)
2 compromised versions
- Feb 23, 2025
Malicious code in metamask-design-tokens-tailwind (npm)
1 compromised version
- Feb 23, 2025
Malicious code in int_pinterest_sfra (npm)
1 compromised version
- Feb 23, 2025
Malicious code in cse-common-arch--long-running-app--create-vm-cf (npm)
1 compromised version
- Feb 23, 2025
Malicious code in bm_pinterest (npm)
1 compromised version
- Feb 23, 2025
Malicious code in app_custom_pinterest (npm)
1 compromised version
- Feb 22, 2025
Malicious code in miniprogram-project (npm)
1 compromised version
- Feb 22, 2025
Malicious code in quickwit-ui (npm)
1 compromised version
- Feb 22, 2025
Malicious code in amagi-kanban (npm)
1 compromised version
- Feb 22, 2025
Malicious code in metamask-sdk-create-react-app (npm)
1 compromised version
- Feb 22, 2025
Malicious code in clubhouse-to-linear-exporter (npm)
1 compromised version
- Feb 21, 2025
Malicious code in solders-utils (PyPI)
1 compromised version
- Feb 21, 2025
Malicious code in solana-utils (PyPI)
2 compromised versions
- Feb 21, 2025
Malicious code in transaction-utils (PyPI)
2 compromised versions
- Feb 21, 2025
Malicious code in @starkgate-v2/web (npm)
1 compromised version
- Feb 21, 2025
Malicious code in champion-trader (npm)
1 compromised version
- Feb 21, 2025
Malicious code in spacelift-webhook-receiver (npm)
1 compromised version
- Feb 21, 2025
Malicious code in @visma-spcs-registry/react-common-components (npm)
2 compromised versions
- Feb 21, 2025
Malicious code in wdpr-test-package (npm)
1 compromised version
- Feb 21, 2025
Malicious code in wdpr-ra-node-mpropz (npm)
1 compromised version
- Feb 21, 2025
Malicious code in wasm-test-adapter (npm)
1 compromised version
- Feb 21, 2025
Malicious code in komojuu (RubyGems)
1 compromised version
- Feb 20, 2025
Malicious code in myconfusedfunctionpoctestpackage (npm)
2 compromised versions
- Feb 20, 2025
Malicious code in mygcpconfusedfunctionpoctestpackage (npm)
1 compromised version
- Feb 20, 2025
Malicious code in storyblok-rich-text-astro-renderer-workspace (npm)
1 compromised version
- Feb 20, 2025
Malicious code in mstplotlib (PyPI)
1 compromised version
- Feb 19, 2025
Malicious code in @roku-web-ui/pills (npm)
1 compromised version
- Feb 19, 2025
Malicious code in @roku-web-ui/standard-footer (npm)
1 compromised version
- Feb 19, 2025
Malicious code in @roku-web-ui/modal (npm)
1 compromised version
- Feb 19, 2025
Malicious code in @supera/shared (npm)
3 compromised versions
- Feb 19, 2025
Malicious code in wkndaemassetcompute (npm)
1 compromised version
Page 6401 of 7,293