Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Feb 3, 2025
Malware in dinacomgraph
1 compromised version
- Feb 3, 2025
Malware in actiris
1 compromised version
- Feb 3, 2025
Malware in hotmart
1 compromised version
- Feb 3, 2025
Malicious code in ing-feat-inbox (npm)
2 compromised versions
- Feb 3, 2025
Malware in ing-feat-inbox
1 compromised version
- Feb 3, 2025
Malicious code in argus3-test (npm)
14 compromised versions
- Feb 3, 2025
Malware in argus3-test
1 compromised version
- Feb 3, 2025
Malicious code in paytm-blink-checkout-vue3-example (npm)
1 compromised version
- Feb 3, 2025
Malicious code in paytm-blink-checkout-vue2-example (npm)
1 compromised version
- Feb 3, 2025
Malicious code in model-viewer-render-fidelity-tools (npm)
1 compromised version
- Feb 3, 2025
Malicious code in deferred-example (npm)
1 compromised version
- Feb 3, 2025
Malware in model-viewer-render-fidelity-tools
1 compromised version
- Feb 3, 2025
Malware in built-with-workers
1 compromised version
- Feb 3, 2025
Malware in paytm-blink-checkout-vue3-example
1 compromised version
- Feb 3, 2025
Malware in deferred-example
1 compromised version
- Feb 3, 2025
Malware in paytm-blink-checkout-vue2-example
1 compromised version
- Feb 3, 2025
Malware in hardhat-dotenv
1 compromised version
- Feb 3, 2025
Malicious code in truelayer-for-woocommerce (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in launchpad-design-system (npm)
- Feb 3, 2025
Malicious code in jetpack-boost (npm)
- Feb 3, 2025
Malicious code in hakana-vscode-plugin (npm)
- Feb 3, 2025
Malicious code in gateway-hsm-sample (npm)
- Feb 3, 2025
Malicious code in core-exchange-spec (npm)
- Feb 3, 2025
Malicious code in climate-tokenization-engine-ui (npm)
- Feb 3, 2025
Malicious code in chialisp-lsp-runner (npm)
- Feb 3, 2025
Malicious code in auth0-logs-to-datadog (npm)
- Feb 3, 2025
Malicious code in aptos-cctp (npm)
- Feb 3, 2025
Malicious code in action-doctl (npm)
- Feb 3, 2025
Malware in launchpad-design-system
1 compromised version
- Feb 3, 2025
Malware in gateway-hsm-sample
1 compromised version
- Feb 3, 2025
Malware in climate-tokenization-engine-ui
1 compromised version
- Feb 3, 2025
Malware in truelayer-for-woocommerce
1 compromised version
- Feb 3, 2025
Malware in aptos-cctp
1 compromised version
- Feb 3, 2025
Malware in action-doctl
1 compromised version
- Feb 3, 2025
Malware in jetpack-boost
1 compromised version
- Feb 3, 2025
Malware in chialisp-lsp-runner
1 compromised version
- Feb 3, 2025
Malware in core-exchange-spec
1 compromised version
- Feb 3, 2025
Malware in auth0-logs-to-datadog
1 compromised version
- Feb 3, 2025
Malware in hakana-vscode-plugin
1 compromised version
- Feb 3, 2025
Malicious code in world-id-cloud-template (npm)
- Feb 3, 2025
Malicious code in tinyquickstartreactnative (npm)
- Feb 3, 2025
Malware in tinyquickstartreactnative
1 compromised version
- Feb 3, 2025
Malware in world-id-cloud-template
1 compromised version
- Feb 3, 2025
Malicious code in pulumi-automation-sdk-ssh-tunnel (npm)
1 compromised version
- Feb 3, 2025
Malware in pulumi-automation-sdk-ssh-tunnel
1 compromised version
- Feb 3, 2025
Malicious code in sg_personal_ui (npm)
1 compromised version
- Feb 3, 2025
Malware in sg_personal_ui
1 compromised version
- Feb 3, 2025
Malicious code in type-fs-extra (npm)
13 compromised versions
- Feb 3, 2025
Malware in type-fs-extra
1 compromised version
- Feb 3, 2025
Malicious code in sendinblue2019 (npm)
3 compromised versions
Page 6441 of 7,308