Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Feb 3, 2025
Malware in sendinblue2019
1 compromised version
- Feb 2, 2025
Malicious code in novatwo (PyPI)
1 compromised version
- Feb 1, 2025
Malicious code in sigma-payment (npm)
1 compromised version
- Feb 1, 2025
Malicious code in hotmart (npm)
1 compromised version
- Feb 1, 2025
Malicious code in actiris (npm)
1 compromised version
- Feb 1, 2025
Malicious code in web3imports (PyPI)
1 compromised version
- Feb 1, 2025
Malicious code in asynchelpers (PyPI)
1 compromised version
- Jan 31, 2025
Malicious code in is-number-ctf (npm)
4 compromised versions
- Jan 31, 2025
Malicious code in victory-native-xl-monorepo (npm)
3 compromised versions
- Jan 31, 2025
Malicious code in dummy-loosesight-gd (npm)
1 compromised version
- Jan 31, 2025
Malicious code in turbolinks_jwt_test2 (npm)
1 compromised version
- Jan 31, 2025
Malicious code in unitedrabbits (npm)
5 compromised versions
- Jan 31, 2025
Malicious code in ua.unitedforbusiness.frontend (npm)
3 compromised versions
- Jan 31, 2025
Malicious code in tittottit (npm)
1 compromised version
- Jan 31, 2025
Malicious code in testingthesand (npm)
1 compromised version
- Jan 31, 2025
Malicious code in skulldentist (npm)
2 compromised versions
- Jan 31, 2025
Malicious code in react-native-country-picker-modal-modified (npm)
1 compromised version
- Jan 31, 2025
Malicious code in prajwal_kewat-test-package (npm)
1 compromised version
- Jan 31, 2025
Malicious code in offer-ui-tools (npm)
1 compromised version
- Jan 31, 2025
Malicious code in nodejs-paypal-checkout-demo (npm)
4 compromised versions
- Jan 31, 2025
Malicious code in jqtools-overlay (npm)
1 compromised version
- Jan 31, 2025
Malicious code in isctf5 (npm)
1 compromised version
- Jan 31, 2025
Malicious code in isctf4 (npm)
1 compromised version
- Jan 31, 2025
Malicious code in isctf3 (npm)
1 compromised version
- Jan 31, 2025
Malicious code in isctf2 (npm)
1 compromised version
- Jan 31, 2025
Malicious code in isctf17 (npm)
1 compromised version
- Jan 31, 2025
Malicious code in isctf16 (npm)
1 compromised version
- Jan 31, 2025
Malicious code in isctf11 (npm)
1 compromised version
- Jan 31, 2025
Malicious code in herostereo (npm)
3 compromised versions
- Jan 31, 2025
Malicious code in gitgotgottten (npm)
2 compromised versions
- Jan 31, 2025
Malicious code in finfonfon (npm)
1 compromised version
- Jan 31, 2025
Malicious code in elabasia-mobileapp-react-native-ui (npm)
4 compromised versions
- Jan 31, 2025
Malicious code in abha (npm)
1 compromised version
- Jan 31, 2025
Malicious code in @wongapl/sliders (npm)
1 compromised version
- Jan 31, 2025
Malicious code in @wongapl/offer-ui-tools (npm)
1 compromised version
- Jan 31, 2025
Malicious code in @wongapl/offer-selector (npm)
1 compromised version
- Jan 31, 2025
Malicious code in @wongapl/offer-digest (npm)
1 compromised version
- Jan 31, 2025
Malicious code in @wongapl/offer-box (npm)
1 compromised version
- Jan 31, 2025
Malicious code in wallet-adapter-demo (npm)
1 compromised version
- Jan 31, 2025
Malicious code in vite-paypal (npm)
4 compromised versions
- Jan 31, 2025
Malicious code in updatelanguagefiles (npm)
1 compromised version
- Jan 31, 2025
Malicious code in smartling-openapi-spec (npm)
1 compromised version
- Jan 31, 2025
Malicious code in qiot (npm)
1 compromised version
- Jan 31, 2025
Malicious code in overture2osmjs (npm)
8 compromised versions
- Jan 31, 2025
Malicious code in npm-website-example (npm)
1 compromised version
- Jan 31, 2025
Malicious code in nlohmann-json (npm)
5 compromised versions
- Jan 31, 2025
Malicious code in mpl-token-metadata (npm)
1 compromised version
- Jan 31, 2025
Malicious code in magic-enum (npm)
8 compromised versions
- Jan 31, 2025
Malicious code in k6-learn (npm)
2 compromised versions
- Jan 31, 2025
Malicious code in flux-example-chat (npm)
1 compromised version
Page 6442 of 7,308