Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Jan 2, 2025
Malicious code in payouts-banking-info (npm)
1 compromised version
- Jan 1, 2025
Malicious code in 029testnpm (npm)
1 compromised version
- Jan 1, 2025
Malware in 029testnpm
1 compromised version
- Dec 31, 2024
Malicious code in babel-preset-app (npm)
6 compromised versions
- Dec 31, 2024
Malicious code in valid-package (npm)
1 compromised version
- Dec 31, 2024
Malicious code in fider (npm)
1 compromised version
- Dec 31, 2024
Malicious code in xeno.dll (npm)
1 compromised version
- Dec 31, 2024
Malicious code in solaraexecutor (npm)
4 compromised versions
- Dec 31, 2024
Malicious code in officebrowserfeedback (npm)
1 compromised version
- Dec 31, 2024
Malicious code in mx-exchange-docs (npm)
1 compromised version
- Dec 31, 2024
Malicious code in bcoin-full (npm)
1 compromised version
- Dec 31, 2024
Malicious code in faucet-microservice (npm)
1 compromised version
- Dec 31, 2024
Malicious code in requetses (PyPI)
2 compromised versions
- Dec 30, 2024
Malicious code in @swiggy-private/analytics (npm)
1 compromised version
- Dec 30, 2024
Malicious code in @swiggy-private/aatm-nirbhar-ui (npm)
1 compromised version
- Dec 30, 2024
Malicious code in @swiggy-private/aatm-nirbhar-build (npm)
1 compromised version
- Dec 30, 2024
Malicious code in @swiggy-private/aatm-nirbhar-bharat-ui (npm)
1 compromised version
- Dec 30, 2024
Withdrawn Advisory: Malware in @swiggy-private/aatm-nirbhar-build
1 compromised version
- Dec 30, 2024
Withdrawn Advisory: Malware in @swiggy-private/analytics
1 compromised version
- Dec 30, 2024
Withdrawn Advisory: Malware in @swiggy-private/aatm-nirbhar-ui
1 compromised version
- Dec 30, 2024
Withdrawn Advisory: Malware in @swiggy-private/aatm-nirbhar-bharat-ui
1 compromised version
- Dec 30, 2024
Malicious code in @swiggy-private/js-utils (npm)
40 compromised versions
- Dec 30, 2024
Malicious code in @swiggy-private/dls-web-core (npm)
5 compromised versions
- Dec 30, 2024
Withdrawn Advisory: Malware in @swiggy-private/dls-web-core
1 compromised version
- Dec 30, 2024
Withdrawn Advisory: Malware in @swiggy-private/js-utils
1 compromised version
- Dec 29, 2024
Malicious code in v2-foundry (npm)
1 compromised version
- Dec 29, 2024
Malicious code in crypto-buddies (npm)
1 compromised version
- Dec 29, 2024
Malicious code in unisocks (npm)
2 compromised versions
- Dec 29, 2024
Malicious code in hugginglega (PyPI)
5 compromised versions
- Dec 29, 2024
Malicious code in dscss (PyPI)
2 compromised versions
- Dec 28, 2024
Malicious code in selenium-plugin (PyPI)
1 compromised version
- Dec 27, 2024
Malicious code in proton-parking-page (npm)
1 compromised version
- Dec 27, 2024
Malicious code in plugin-sitemap-coveo (npm)
1 compromised version
- Dec 27, 2024
Malicious code in vesu_changelog (npm)
1 compromised version
- Dec 27, 2024
Malicious code in dev-journey-app (npm)
1 compromised version
- Dec 27, 2024
Malicious code in kubehook (npm)
8 compromised versions
- Dec 27, 2024
Malware in kubehook
1 compromised version
- Dec 27, 2024
Malicious code in do-not-install-this-plz (npm)
3 compromised versions
- Dec 27, 2024
Malware in do-not-install-this-plz
1 compromised version
- Dec 27, 2024
Malware in web-live-sdk
1 compromised version
- Dec 27, 2024
Malicious code in devnet-deploy (npm)
1 compromised version
- Dec 27, 2024
Malicious code in data-strategy (npm)
1 compromised version
- Dec 27, 2024
Malicious code in centers-of-excellence (npm)
1 compromised version
- Dec 27, 2024
Malware in fidentity-website
1 compromised version
- Dec 27, 2024
Malware in casino-luzern-easter-frontend
1 compromised version
- Dec 27, 2024
Malware in centers-of-excellence
1 compromised version
- Dec 27, 2024
Malware in lido-on-ethereum
1 compromised version
- Dec 27, 2024
Malware in data-strategy
1 compromised version
- Dec 27, 2024
Malware in devnet-deploy
1 compromised version
- Dec 27, 2024
Malicious code in sovryn (npm)
1 compromised version
Page 6465 of 7,308