Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Dec 19, 2024
Malware in zarf-ui
1 compromised version
- Dec 19, 2024
Malware in apache-airflow-ui
1 compromised version
- Dec 19, 2024
Malware in serum-dex-ui
1 compromised version
- Dec 19, 2024
Malicious code in scalavex (npm)
1 compromised version
- Dec 19, 2024
Malware in scalavex
1 compromised version
- Dec 19, 2024
Malicious code in rodas (npm)
- Dec 19, 2024
Malware in rodas
1 compromised version
- Dec 19, 2024
Malicious code in react-multer (npm)
- Dec 19, 2024
Malware in react-multer
1 compromised version
- Dec 19, 2024
Malicious code in uiqweyruhen (npm)
- Dec 19, 2024
Malicious code in uieyruhen (npm)
- Dec 19, 2024
Malicious code in rdjjfjooirpp.js (npm)
1 compromised version
- Dec 19, 2024
Malware in uieyruhen
1 compromised version
- Dec 19, 2024
Malware in uiqweyruhen
1 compromised version
- Dec 19, 2024
Malware in rdjjfjooirpp.js
1 compromised version
- Dec 19, 2024
Malware in rc-network
1 compromised version
- Dec 19, 2024
Malware in raptor-library
1 compromised version
- Dec 19, 2024
Malicious code in rafarafa_package (npm)
- Dec 19, 2024
Malware in rafarafa_package
1 compromised version
- Dec 19, 2024
Malicious code in pushservicejs (npm)
- Dec 19, 2024
Malware in pushservicejs
1 compromised version
- Dec 19, 2024
Malicious code in private-bug-bounty-secret (npm)
3 compromised versions
- Dec 19, 2024
Malicious code in private-bug-bounty (npm)
1 compromised version
- Dec 19, 2024
Malicious code in cokie-secret (npm)
1 compromised version
- Dec 19, 2024
Malware in cokie-secret
1 compromised version
- Dec 19, 2024
Malware in private-bug-bounty-secret
1 compromised version
- Dec 19, 2024
Malware in private-bug-bounty
1 compromised version
- Dec 19, 2024
Malware in web-app-search
1 compromised version
- Dec 19, 2024
Malware in prettier-v3-for-testing
1 compromised version
- Dec 19, 2024
Malicious code in ppw (npm)
- Dec 19, 2024
Malware in ppw
1 compromised version
- Dec 19, 2024
Malicious code in pnpm-run (npm)
- Dec 19, 2024
Malware in pnpm-run
1 compromised version
- Dec 19, 2024
Malicious code in non-existing-dependency (npm)
1 compromised version
- Dec 19, 2024
Malicious code in o-share (npm)
1 compromised version
- Dec 19, 2024
Malware in o-share
1 compromised version
- Dec 19, 2024
Malware in passport-openpass-example
1 compromised version
- Dec 19, 2024
Malware in openpass-sample-sites-piano-io
1 compromised version
- Dec 19, 2024
Malware in openpass-sample-sites-client-js-sdk
1 compromised version
- Dec 19, 2024
Malicious code in oj-odcs-selector-common (npm)
- Dec 19, 2024
Malicious code in oj-odcs-product-selector (npm)
- Dec 19, 2024
Malicious code in oj-odcs-linked-text (npm)
- Dec 19, 2024
Malicious code in oj-odcs-fontawesome (npm)
- Dec 19, 2024
Malicious code in oj-odcs-category-selector (npm)
2 compromised versions
- Dec 19, 2024
Malware in oj-odcs-linked-text
1 compromised version
- Dec 19, 2024
Malware in oj-odcs-category-selector
1 compromised version
- Dec 19, 2024
Malware in oj-odcs-product-selector
1 compromised version
- Dec 19, 2024
Malware in oj-odcs-fontawesome
1 compromised version
- Dec 19, 2024
Malware in oj-odcs-selector-common
1 compromised version
- Dec 19, 2024
Malware in nylas-private-fonts
1 compromised version
Page 6469 of 7,308