Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Dec 20, 2024
Malicious code in kubernetes-jobs-javascript (npm)
1 compromised version
- Dec 20, 2024
Malicious code in layerzero-v2 (npm)
1 compromised version
- Dec 20, 2024
Malicious code in api-demo-sample-lib1 (npm)
1 compromised version
- Dec 20, 2024
Malicious code in grafana-report-panel (npm)
1 compromised version
- Dec 20, 2024
Malicious code in @rrvis/code-mapper (npm)
3 compromised versions
- Dec 20, 2024
Malicious code in @rrvis/dialog (npm)
3 compromised versions
- Dec 20, 2024
Malicious code in shahwar-demo (npm)
1 compromised version
- Dec 20, 2024
Malicious code in 4m-clean-shopify-app (npm)
4 compromised versions
- Dec 20, 2024
Malicious code in mindmeld-ui (npm)
1 compromised version
- Dec 20, 2024
Malicious code in yb2bacceleratorstorefront-web (npm)
1 compromised version
- Dec 20, 2024
Malicious code in squirreldisk-tauri (npm)
2 compromised versions
- Dec 20, 2024
Malicious code in nuget.shouldly (npm)
2 compromised versions
- Dec 20, 2024
Malicious code in aauto-assign-team-action (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in @rrvis/ui (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in @rrvis/util (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in @rrvis/epaas (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in @rrvis/vehicle (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in @rrvis/logger (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in piepunk (PyPI)
3 compromised versions
- Dec 19, 2024
Malicious code in tracking-protection-experiment (npm)
1 compromised version
- Dec 19, 2024
Malicious code in com.unity.assetgraph (npm)
1 compromised version
- Dec 19, 2024
Malicious code in @metrics-service/mf-client (npm)
1 compromised version
- Dec 19, 2024
Malware in @metrics-service/mf-client
1 compromised version
- Dec 19, 2024
Malicious code in editions-dev-workshop (npm)
1 compromised version
- Dec 19, 2024
Malicious code in @add-wallet-exchange/type-api-data (npm)
- Dec 19, 2024
Malicious code in @add-wallet-exchange/set-imported-csv-message (npm)
- Dec 19, 2024
Malicious code in @add-wallet-exchange/reset (npm)
- Dec 19, 2024
Malicious code in @add-wallet-exchange/import-type (npm)
- Dec 19, 2024
Malware in @add-wallet-exchange/type-api-data
1 compromised version
- Dec 19, 2024
Malware in @add-wallet-exchange/import-type
1 compromised version
- Dec 19, 2024
Malware in @add-wallet-exchange/set-imported-csv-message
1 compromised version
- Dec 19, 2024
Malware in @add-wallet-exchange/reset
1 compromised version
- Dec 19, 2024
Malicious code in tiktok_embed_v2 (npm)
3 compromised versions
- Dec 19, 2024
Malware in tiktok_embed_v2
1 compromised version
- Dec 19, 2024
Malicious code in ssk (npm)
- Dec 19, 2024
Malware in ssk
1 compromised version
- Dec 19, 2024
Malicious code in zap_contracts (npm)
1 compromised version
- Dec 19, 2024
Malware in playwright-1.46
1 compromised version
- Dec 19, 2024
Malware in spinal-env-viewer-plugin-group-manager-service
1 compromised version
- Dec 19, 2024
Malware in zap_contracts
1 compromised version
- Dec 19, 2024
Malicious code in yapi-to-dts (npm)
1 compromised version
- Dec 19, 2024
Malicious code in spid-csvautofilljs (npm)
2 compromised versions
- Dec 19, 2024
Malware in vite-plugin-unus-api-register
1 compromised version
- Dec 19, 2024
Malware in yapi-to-dts
1 compromised version
- Dec 19, 2024
Malware in sso-map
1 compromised version
- Dec 19, 2024
Malware in spid-csvautofilljs
1 compromised version
- Dec 19, 2024
Malware in shopee-form-ui
1 compromised version
- Dec 19, 2024
Malicious code in zarf-ui (npm)
- Dec 19, 2024
Malicious code in serum-dex-ui (npm)
- Dec 19, 2024
Malicious code in apache-airflow-ui (npm)
2 compromised versions
Page 6468 of 7,308