Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Jan 21, 2025
Malicious code in plans-grid (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in dops-components (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in domain-picker (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in design-preview (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in design-picker (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in design-carousel (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in custom-colors-loader (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in create-calypso-config (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in blockapis (npm)
- Jan 21, 2025
Malware in sdk-coin-algo
1 compromised version
- Jan 21, 2025
Malware in webpack-inline-constant-exports-plugin
1 compromised version
- Jan 21, 2025
Malware in sdk-coin-bch
1 compromised version
- Jan 21, 2025
Malware in design-picker
1 compromised version
- Jan 21, 2025
Malware in tour-kit
1 compromised version
- Jan 21, 2025
Malware in sdk-coin-ada
1 compromised version
- Jan 21, 2025
Malware in create-calypso-config
1 compromised version
- Jan 21, 2025
Malware in sdk-coin-avaxp
1 compromised version
- Jan 21, 2025
Malware in request-external-access
1 compromised version
- Jan 21, 2025
Malware in sdk-coin-bsc
1 compromised version
- Jan 21, 2025
Malware in sdk-coin-avaxc
1 compromised version
- Jan 21, 2025
Malware in domain-picker
1 compromised version
- Jan 21, 2025
Malware in site-picker
1 compromised version
- Jan 21, 2025
Malware in webpack-extensive-lodash-replacement-plugin
1 compromised version
- Jan 21, 2025
Malware in dops-components
1 compromised version
- Jan 21, 2025
Malware in popup-monitor
1 compromised version
- Jan 21, 2025
Malware in design-carousel
1 compromised version
- Jan 21, 2025
Malware in sdk-coin-bsv
1 compromised version
- Jan 21, 2025
Malware in design-preview
1 compromised version
- Jan 21, 2025
Malware in blockapis
1 compromised version
- Jan 21, 2025
Malware in plans-grid
1 compromised version
- Jan 21, 2025
Malware in social-previews
1 compromised version
- Jan 21, 2025
Malware in custom-colors-loader
1 compromised version
- Jan 21, 2025
Malware in sdk-coin-bcha
1 compromised version
- Jan 21, 2025
Malware in wp-babel-makepot
1 compromised version
- Jan 21, 2025
Malware in sdk-coin-btc
1 compromised version
- Jan 21, 2025
Malware in viewport-react
1 compromised version
- Jan 21, 2025
Malicious code in ui-components-shared (npm)
9 compromised versions
- Jan 21, 2025
Malicious code in ui-components-highlight-vdom (npm)
9 compromised versions
- Jan 21, 2025
Malicious code in lit-mobx (npm)
16 compromised versions
- Jan 21, 2025
Malicious code in eslint-config-atlassian-fecq (npm)
10 compromised versions
- Jan 21, 2025
Malicious code in composite-checkout (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in calypso-url (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in calypso-typescript-config (npm)
2 compromised versions
- Jan 21, 2025
Malicious code in babel-plugin-i18n-calypso (npm)
11 compromised versions
- Jan 21, 2025
Malicious code in autocomplete-theme-classic (npm)
10 compromised versions
- Jan 21, 2025
Malicious code in aem-spa-page-model-manager (npm)
11 compromised versions
- Jan 21, 2025
Malicious code in aem-spa-component-mapping (npm)
13 compromised versions
- Jan 21, 2025
Malware in composite-checkout
1 compromised version
- Jan 21, 2025
Malware in ui-components-highlight-vdom
1 compromised version
- Jan 21, 2025
Malware in autocomplete-theme-classic
1 compromised version
Page 6453 of 7,308