Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Jan 22, 2025
Malicious code in passkeys-resources-website (npm)
1 compromised version
- Jan 22, 2025
Malware in passkeys-resources-website
1 compromised version
- Jan 22, 2025
Malicious code in libcrypt-test (npm)
- Jan 22, 2025
Malicious code in libcrypt-js (npm)
- Jan 22, 2025
Malicious code in libcrypt (npm)
- Jan 22, 2025
Malware in libcrypt-js
1 compromised version
- Jan 22, 2025
Malware in libcrypt-test
1 compromised version
- Jan 22, 2025
Malware in libcrypt
1 compromised version
- Jan 22, 2025
Malicious code in built-with-workers (npm)
1 compromised version
- Jan 22, 2025
Malicious code in canva-connect-api-starter-kit (npm)
1 compromised version
- Jan 22, 2025
Malicious code in mathworks.github.io (npm)
1 compromised version
- Jan 22, 2025
Malicious code in apple.github.io (npm)
1 compromised version
- Jan 22, 2025
Malicious code in charjs (npm)
- Jan 22, 2025
Malware in charjs
1 compromised version
- Jan 21, 2025
Malicious code in mlc-llm-nightly-cu123 (PyPI)
1 compromised version
- Jan 21, 2025
Malicious code in mlc-ai-nightly-rocm62 (PyPI)
1 compromised version
- Jan 21, 2025
Malicious code in mlc-ai-nightly-cu123 (PyPI)
1 compromised version
- Jan 21, 2025
Malicious code in mlc-ai-nightly (PyPI)
3 compromised versions
- Jan 21, 2025
Malicious code in arcus-cmd-utils (npm)
1 compromised version
- Jan 21, 2025
Malicious code in cschalk-next (npm)
1 compromised version
- Jan 21, 2025
Malicious code in cschalk (npm)
1 compromised version
- Jan 21, 2025
Malicious code in cscchokidar-next (npm)
1 compromised version
- Jan 21, 2025
Malicious code in csbchalk-next (npm)
1 compromised version
- Jan 21, 2025
Malicious code in achalk-next (npm)
1 compromised version
- Jan 21, 2025
Malicious code in marked-as (npm)
3 compromised versions
- Jan 21, 2025
Malicious code in fast-utilz (npm)
1 compromised version
- Jan 21, 2025
Malicious code in marked-at (npm)
1 compromised version
- Jan 21, 2025
Malicious code in outlookapi (npm)
3 compromised versions
- Jan 21, 2025
Malicious code in ethweb-set (npm)
1 compromised version
- Jan 21, 2025
Malicious code in secure-toolbots (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in tr46mine (npm)
1 compromised version
- Jan 21, 2025
Malicious code in extendmine (npm)
1 compromised version
- Jan 21, 2025
Malicious code in wp-babel-makepot (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in webpack-inline-constant-exports-plugin (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in webpack-extensive-lodash-replacement-plugin (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in viewport-react (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in tour-kit (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in social-previews (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in site-picker (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in sdk-coin-btc (npm)
- Jan 21, 2025
Malicious code in sdk-coin-bsv (npm)
- Jan 21, 2025
Malicious code in sdk-coin-bsc (npm)
- Jan 21, 2025
Malicious code in sdk-coin-bcha (npm)
- Jan 21, 2025
Malicious code in sdk-coin-bch (npm)
- Jan 21, 2025
Malicious code in sdk-coin-avaxp (npm)
- Jan 21, 2025
Malicious code in sdk-coin-avaxc (npm)
- Jan 21, 2025
Malicious code in sdk-coin-algo (npm)
- Jan 21, 2025
Malicious code in sdk-coin-ada (npm)
- Jan 21, 2025
Malicious code in request-external-access (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in popup-monitor (npm)
2 compromised versions
Page 6452 of 7,308