Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Dec 19, 2024
Malware in nylas-private-sounds
1 compromised version
- Dec 19, 2024
Malicious code in network-test-poc (npm)
1 compromised version
- Dec 19, 2024
Malware in network-test-poc
1 compromised version
- Dec 19, 2024
Malicious code in mina-bridge (npm)
2 compromised versions
- Dec 19, 2024
Malware in zkonmina
1 compromised version
- Dec 19, 2024
Malware in mina-bridge
1 compromised version
- Dec 19, 2024
Malicious code in meu-script (npm)
- Dec 19, 2024
Malware in meu-script
1 compromised version
- Dec 19, 2024
Malicious code in playwright-1.48 (npm)
1 compromised version
- Dec 19, 2024
Malicious code in mediafragment (npm)
1 compromised version
- Dec 19, 2024
Malware in playwright-1.48
1 compromised version
- Dec 19, 2024
Malware in spinal-service-ticket
1 compromised version
- Dec 19, 2024
Malware in mediafragment
1 compromised version
- Dec 19, 2024
Malicious code in maplibre (npm)
2 compromised versions
- Dec 19, 2024
Malware in maplibre
1 compromised version
- Dec 19, 2024
Malicious code in linecorp (npm)
4 compromised versions
- Dec 19, 2024
Malware in linecorp
1 compromised version
- Dec 19, 2024
Malware in spinal-lib-organ-monitoring
1 compromised version
- Dec 19, 2024
Malware in language-babel
1 compromised version
- Dec 19, 2024
Malware in playwright-1.47
1 compromised version
- Dec 19, 2024
Malicious code in internallib_v871 (npm)
- Dec 19, 2024
Malicious code in internallib_v693 (npm)
- Dec 19, 2024
Malware in internallib_v871
1 compromised version
- Dec 19, 2024
Malware in internallib_v693
1 compromised version
- Dec 19, 2024
Malicious code in internallib_v420 (npm)
1 compromised version
- Dec 19, 2024
Malware in internallib_v420
1 compromised version
- Dec 19, 2024
Malicious code in internallib_v15 (npm)
- Dec 19, 2024
Malware in internallib_v15
1 compromised version
- Dec 19, 2024
Malicious code in uid-2-test-ts (npm)
1 compromised version
- Dec 19, 2024
Malicious code in iabgpp (npm)
- Dec 19, 2024
Malware in uid-2-test-ts
1 compromised version
- Dec 19, 2024
Malware in iabgpp
1 compromised version
- Dec 19, 2024
Malware in tc-portal
1 compromised version
- Dec 19, 2024
Malware in uid2-publisher
1 compromised version
- Dec 19, 2024
Malicious code in hyperion-react-testapp (npm)
1 compromised version
- Dec 19, 2024
Malware in hyperion-react-testapp
1 compromised version
- Dec 19, 2024
Malicious code in blz-internal-pkg_update (npm)
5 compromised versions
- Dec 19, 2024
Malicious code in host-exploit (npm)
- Dec 19, 2024
Malware in host-exploit
1 compromised version
- Dec 19, 2024
Malicious code in healenium (npm)
4 compromised versions
- Dec 19, 2024
Malware in healenium
1 compromised version
- Dec 19, 2024
Malicious code in spinal-env-viewer-plugin-documentation-service (npm)
1 compromised version
- Dec 19, 2024
Malware in vue-midata
1 compromised version
- Dec 19, 2024
Malware in h5bp-docs
1 compromised version
- Dec 19, 2024
Malware in playwright-1.45
1 compromised version
- Dec 19, 2024
Malware in spinal-env-viewer-plugin-documentation-service
1 compromised version
- Dec 19, 2024
Malicious code in vintage-poc (npm)
1 compromised version
- Dec 19, 2024
Malicious code in grid-context (npm)
1 compromised version
- Dec 19, 2024
Malware in grid-context
1 compromised version
- Dec 19, 2024
Malware in vintage-poc
1 compromised version
Page 6470 of 7,308