Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Jan 20, 2025
Malware in vesu_changelog
1 compromised version
- Jan 20, 2025
Malware in atlaspack-transformer-string
1 compromised version
- Jan 20, 2025
Malware in vuepress-reading-time-extended
1 compromised version
- Jan 20, 2025
Malware in api-extractor-lib1-test
1 compromised version
- Jan 20, 2025
Malware in dotgov-list
1 compromised version
- Jan 20, 2025
Malware in emoji-datasource-google-blob
1 compromised version
- Jan 20, 2025
Malware in plugin-sitemap-coveo
1 compromised version
- Jan 20, 2025
Malware in dbx-js-tools
1 compromised version
- Jan 20, 2025
Malware in react-spring-latest
1 compromised version
- Jan 20, 2025
Malware in glia-widgets-ionic
1 compromised version
- Jan 20, 2025
Malware in vscode-tcf-debug
1 compromised version
- Jan 20, 2025
Malware in pyroscope-oss
1 compromised version
- Jan 20, 2025
Malware in prh-rules
1 compromised version
- Jan 20, 2025
Malware in nr-reports-core
1 compromised version
- Jan 20, 2025
Malware in eslint-v7
1 compromised version
- Jan 20, 2025
Malware in lichess-org
1 compromised version
- Jan 20, 2025
Malware in devopt
1 compromised version
- Jan 20, 2025
Malware in bbm-enterprise
1 compromised version
- Jan 20, 2025
Malware in imports_exports
1 compromised version
- Jan 20, 2025
Malware in bridge-transaction-parser
1 compromised version
- Jan 20, 2025
Malware in valid-package
1 compromised version
- Jan 20, 2025
Malicious code in zk-settlement-client (npm)
1 compromised version
- Jan 20, 2025
Malicious code in zd-css-bedrock (npm)
1 compromised version
- Jan 20, 2025
Malicious code in webpack-next (npm)
1 compromised version
- Jan 20, 2025
Malicious code in vue-loader-vue3 (npm)
1 compromised version
- Jan 20, 2025
Malicious code in stylexjs-scripts (npm)
1 compromised version
- Jan 20, 2025
Malicious code in ssv-sdk (npm)
1 compromised version
- Jan 20, 2025
Malicious code in solhint-config-keep (npm)
1 compromised version
- Jan 20, 2025
Malicious code in smrf-test (npm)
1 compromised version
- Jan 20, 2025
Malicious code in pilcom2 (npm)
1 compromised version
- Jan 20, 2025
Malicious code in delegator-core-viem (npm)
- Jan 20, 2025
Malicious code in dds-js-devkit (npm)
1 compromised version
- Jan 20, 2025
Malicious code in borsh-js (npm)
1 compromised version
- Jan 20, 2025
Malicious code in api-demo-sample-lib2 (npm)
- Jan 20, 2025
Malicious code in anotherexternal (npm)
- Jan 20, 2025
Malicious code in aaguid (npm)
1 compromised version
- Jan 20, 2025
Malware in anotherexternal
1 compromised version
- Jan 20, 2025
Malware in ssv-sdk
1 compromised version
- Jan 20, 2025
Malware in dds-js-devkit
1 compromised version
- Jan 20, 2025
Malware in non-existing-dependency
1 compromised version
- Jan 20, 2025
Malware in borsh-js
1 compromised version
- Jan 20, 2025
Malware in api-demo-sample-lib2
1 compromised version
- Jan 20, 2025
Malware in zk-settlement-client
1 compromised version
- Jan 20, 2025
Malware in pilcom2
1 compromised version
- Jan 20, 2025
Malware in zd-css-bedrock
1 compromised version
- Jan 20, 2025
Malware in contentsdk-node
1 compromised version
- Jan 20, 2025
Malware in smrf-test
1 compromised version
- Jan 20, 2025
Malware in vue-loader-vue3
1 compromised version
- Jan 20, 2025
Malware in delegator-core-viem
1 compromised version
- Jan 20, 2025
Malware in id-assert-authz-grant-client
1 compromised version
Page 6458 of 7,308