Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Dec 24, 2024
Malicious code in reqeuts (PyPI)
2 compromised versions
- Dec 24, 2024
Malicious code in reqest (PyPI)
3 compromised versions
- Dec 24, 2024
Malicious code in reqesst (PyPI)
1 compromised version
- Dec 24, 2024
Malicious code in flasl (PyPI)
2 compromised versions
- Dec 24, 2024
Malicious code in fkask (PyPI)
1 compromised version
- Dec 24, 2024
Malicious code in fflask (PyPI)
3 compromised versions
- Dec 24, 2024
Malicious code in falask (PyPI)
1 compromised version
- Dec 24, 2024
Malicious code in requesr (PyPI)
2 compromised versions
- Dec 24, 2024
Malicious code in gravity-bridge-site (npm)
2 compromised versions
- Dec 24, 2024
Malicious code in handyfiles (PyPI)
1 compromised version
- Dec 24, 2024
Malicious code in filecraft (PyPI)
1 compromised version
- Dec 24, 2024
Malicious code in react-release-manager (npm)
2 compromised versions
- Dec 24, 2024
Malicious code in old-celo-identity (npm)
1 compromised version
- Dec 24, 2024
Malicious code in distylai (npm)
2 compromised versions
- Dec 24, 2024
Malicious code in react-spring-latest (npm)
1 compromised version
- Dec 23, 2024
Malicious code in testforyt7hb (npm)
2 compromised versions
- Dec 23, 2024
Malicious code in tree-sitter-dockerfile (npm)
1 compromised version
- Dec 23, 2024
Malicious code in cloudinary-ct-run-sub (npm)
1 compromised version
- Dec 23, 2024
Malicious code in precompiled-wasabi100 (npm)
1 compromised version
- Dec 23, 2024
Malicious code in rsk-transaction-helper (npm)
1 compromised version
- Dec 23, 2024
Malicious code in wdio-common (npm)
3 compromised versions
- Dec 23, 2024
Malicious code in bridge-transaction-parser-hop400 (npm)
3 compromised versions
- Dec 23, 2024
Malicious code in powpeg (npm)
1 compromised version
- Dec 23, 2024
Malicious code in wp-crontrol (npm)
1 compromised version
- Dec 23, 2024
Malicious code in oauth2-jwt-bearer (npm)
1 compromised version
- Dec 23, 2024
Malicious code in ing-feat-business-intermediary-lease-calculator (npm)
1 compromised version
- Dec 23, 2024
Malicious code in ing-feat-business-lending-financieringscheck (npm)
1 compromised version
- Dec 23, 2024
Malicious code in ing-lib-lease-calculator (npm)
1 compromised version
- Dec 23, 2024
Malicious code in tree-sitter-r (npm)
1 compromised version
- Dec 23, 2024
Malicious code in opsgeniewebhook (npm)
2 compromised versions
- Dec 22, 2024
Malicious code in widgets-mainappointments (npm)
1 compromised version
- Dec 22, 2024
Malicious code in openai-extension (npm)
1 compromised version
- Dec 22, 2024
Malicious code in lib-wallet-store (npm)
1 compromised version
- Dec 22, 2024
Malicious code in id-assert-authz-grant-client (npm)
1 compromised version
- Dec 22, 2024
Malicious code in conversations-embed (npm)
2 compromised versions
- Dec 22, 2024
Malicious code in ui-forms-embed-components-reporting (npm)
1 compromised version
- Dec 22, 2024
Malicious code in parliament-ui-components (npm)
1 compromised version
- Dec 21, 2024
Malicious code in app-settings-template (npm)
1 compromised version
- Dec 21, 2024
Malicious code in goji-js-org (npm)
2 compromised versions
- Dec 21, 2024
Malicious code in react-native-simpl (npm)
1 compromised version
- Dec 21, 2024
Malicious code in cosmos-hub-docs-site (npm)
1 compromised version
- Dec 21, 2024
Malicious code in owncloud-customgroups-dev (npm)
1 compromised version
- Dec 21, 2024
Malicious code in dynamodb-data-mapper-js (npm)
1 compromised version
- Dec 21, 2024
Malicious code in mono-faucet (npm)
1 compromised version
- Dec 21, 2024
Malicious code in @shahwarhello/l2geth (npm)
1 compromised version
- Dec 21, 2024
Malicious code in lerna-monorepo2 (npm)
1 compromised version
- Dec 20, 2024
Malicious code in testbyakash2310xxxxxxxnowaympasti (npm)
1 compromised version
- Dec 20, 2024
Malicious code in testbyakash2310please (npm)
1 compromised version
- Dec 20, 2024
Malicious code in security-admin (npm)
1 compromised version
- Dec 20, 2024
Malicious code in phonepe-payment-capacitor (npm)
1 compromised version
Page 6467 of 7,308