Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Jan 13, 2025
Malware in zqdl55512
1 compromised version
- Jan 13, 2025
Malware in zqdl0
1 compromised version
- Jan 13, 2025
Malware in zqdl5553
1 compromised version
- Jan 13, 2025
Malware in zqdl5552
1 compromised version
- Jan 13, 2025
Malware in zqdl55513
1 compromised version
- Jan 13, 2025
Malware in zqdl55511
1 compromised version
- Jan 13, 2025
Malicious code in zqdl555147 (npm)
- Jan 13, 2025
Malware in zqdl333
1 compromised version
- Jan 13, 2025
Malware in zqdl222
1 compromised version
- Jan 13, 2025
Malware in zqdl111
1 compromised version
- Jan 13, 2025
Malware in zqdl555147
1 compromised version
- Jan 13, 2025
Malicious code in prettier-s (npm)
- Jan 13, 2025
Malware in marked-cs
1 compromised version
- Jan 13, 2025
Malware in marked-ps
1 compromised version
- Jan 13, 2025
Malware in prettier-s
1 compromised version
- Jan 13, 2025
Malicious code in parseq-tracevis (npm)
2 compromised versions
- Jan 13, 2025
Malicious code in bigcommerce-cornerstone (npm)
3 compromised versions
- Jan 13, 2025
Malicious code in vscode-gestalt (npm)
1 compromised version
- Jan 13, 2025
Malicious code in gatsby-hampton-theme (npm)
1 compromised version
- Jan 13, 2025
Malicious code in build-stuff (npm)
1 compromised version
- Jan 13, 2025
Malicious code in mlb-site-core (npm)
4 compromised versions
- Jan 13, 2025
Malicious code in jiolocate-ui (npm)
1 compromised version
- Jan 13, 2025
Malicious code in romanes-eunt-domus-jd-1337 (npm)
15 compromised versions
- Jan 12, 2025
Malicious code in marked-ps (npm)
8 compromised versions
- Jan 12, 2025
Malicious code in marked-cs (npm)
13 compromised versions
- Jan 10, 2025
Malicious code in dexscreener (npm)
- Jan 10, 2025
Malware in dexscreener
1 compromised version
- Jan 10, 2025
Malicious code in solana-transaction-toolkit (npm)
- Jan 10, 2025
Malicious code in solana-stable-web-huks (npm)
- Jan 10, 2025
Malware in solana-stable-web-huks
1 compromised version
- Jan 10, 2025
Malware in solana-transaction-toolkit
1 compromised version
- Jan 10, 2025
Malicious code in secure-toolkits (npm)
1 compromised version
- Jan 10, 2025
Malicious code in utf-cleaner (PyPI)
6 compromised versions
- Jan 10, 2025
Malicious code in javascan (PyPI)
5 compromised versions
- Jan 10, 2025
Malicious code in just-test-framework (PyPI)
2 compromised versions
- Jan 10, 2025
Malicious code in just-framework (PyPI)
1 compromised version
- Jan 10, 2025
Malicious code in djangoframework-test (PyPI)
1 compromised version
- Jan 9, 2025
Malicious code in hardhat-dotenv (npm)
2 compromised versions
- Jan 8, 2025
Malicious code in alchemy-web3-webpack-example (npm)
1 compromised version
- Jan 8, 2025
Malicious code in shopify-ecommerce-shopping-cart (npm)
1 compromised version
- Jan 8, 2025
Malicious code in digitalexp-lowcode-runner-app (npm)
1 compromised version
- Jan 8, 2025
Malicious code in @shadowbyte/checkout-telemetry-agent (npm)
1 compromised version
- Jan 8, 2025
Malicious code in kiota-typescript (npm)
1 compromised version
- Jan 8, 2025
Malicious code in keeper-secrets-manager (npm)
3 compromised versions
- Jan 8, 2025
Malicious code in jupyter-binding (npm)
1 compromised version
- Jan 8, 2025
Malicious code in electron-wix-msi-local (npm)
1 compromised version
- Jan 8, 2025
Malicious code in aem-guides-wknd-app (npm)
1 compromised version
- Jan 7, 2025
Malicious code in pre-commit-tasks (npm)
1 compromised version
- Jan 7, 2025
Malicious code in hts-open-dex-react-ui (npm)
1 compromised version
- Jan 7, 2025
Malicious code in innocent-package (npm)
1 compromised version
Page 6463 of 7,308