Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Dec 19, 2024
Malicious code in gft-view-helpers (npm)
- Dec 19, 2024
Malicious code in gft-sam-connector (npm)
- Dec 19, 2024
Malicious code in gft-model-utils (npm)
- Dec 19, 2024
Malware in gft-view-helpers
1 compromised version
- Dec 19, 2024
Malware in gft-sam-connector
1 compromised version
- Dec 19, 2024
Malware in gft-model-utils
1 compromised version
- Dec 19, 2024
Malicious code in gatsby-plugin-guru-export (npm)
2 compromised versions
- Dec 19, 2024
Malware in gatsby-plugin-guru-export
1 compromised version
- Dec 19, 2024
Malicious code in template-fullstack (npm)
1 compromised version
- Dec 19, 2024
Malware in template-fullstack
1 compromised version
- Dec 19, 2024
Malware in spinal-env-viewer-graph-service
1 compromised version
- Dec 19, 2024
Malware in fluid-tooltip
1 compromised version
- Dec 19, 2024
Malware in spinal-core-connectorjs_type
1 compromised version
- Dec 19, 2024
Malware in dhp-logging-lib
1 compromised version
- Dec 19, 2024
Malicious code in reftest-helper-for-ae1x (npm)
1 compromised version
- Dec 19, 2024
Malicious code in fluid-renderer (npm)
1 compromised version
- Dec 19, 2024
Malware in reftest-helper-for-ae1x
1 compromised version
- Dec 19, 2024
Malware in fluid-renderer
1 compromised version
- Dec 19, 2024
Malicious code in gps-gateway-client (npm)
- Dec 19, 2024
Malware in gps-gateway-client
1 compromised version
- Dec 19, 2024
Malware in flpweb
1 compromised version
- Dec 19, 2024
Malicious code in reftest-helper (npm)
1 compromised version
- Dec 19, 2024
Malicious code in firebase-simple-login (npm)
1 compromised version
- Dec 19, 2024
Malicious code in dhp-http-lib (npm)
1 compromised version
- Dec 19, 2024
Malware in spinal-core-connectorjs
1 compromised version
- Dec 19, 2024
Malware in reftest-helper
1 compromised version
- Dec 19, 2024
Malware in dhp-http-lib
1 compromised version
- Dec 19, 2024
Malware in firebase-simple-login
1 compromised version
- Dec 19, 2024
Malicious code in evil-package-for-test2 (npm)
1 compromised version
- Dec 19, 2024
Malware in evil-package-for-test2
1 compromised version
- Dec 19, 2024
Malicious code in otc-echo (npm)
1 compromised version
- Dec 19, 2024
Malware in readium-css
1 compromised version
- Dec 19, 2024
Malware in com.unity.entities
1 compromised version
- Dec 19, 2024
Malware in eslint-config-sunset-nodejs
1 compromised version
- Dec 19, 2024
Malware in otc-echo
1 compromised version
- Dec 19, 2024
Malware in tauri-plugin-autostart-api
1 compromised version
- Dec 19, 2024
Malicious code in eslint-config-extraterm (npm)
1 compromised version
- Dec 19, 2024
Malware in eslint-config-extraterm
1 compromised version
- Dec 19, 2024
Malware in qt-construct
1 compromised version
- Dec 19, 2024
Malware in tailchat-service-swagger-generator
1 compromised version
- Dec 19, 2024
Malware in com.unity.collections
1 compromised version
- Dec 19, 2024
Malicious code in eritiopitop (npm)
1 compromised version
- Dec 19, 2024
Malware in eritiopitop
1 compromised version
- Dec 19, 2024
Malicious code in ecpfs-react-build-scripts (npm)
1 compromised version
- Dec 19, 2024
Malware in ecpfs-react-build-scripts
1 compromised version
- Dec 19, 2024
Malicious code in ecpfs-react-data-driven-components (npm)
1 compromised version
- Dec 19, 2024
Malicious code in ecpfs-authority (npm)
3 compromised versions
- Dec 19, 2024
Malware in ecpfs-authority
1 compromised version
- Dec 19, 2024
Malware in ecpfs-react-data-driven-components
1 compromised version
- Dec 19, 2024
Malicious code in yb-animations (npm)
1 compromised version
Page 6471 of 7,308