Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,383 total · sorted newest first- Dec 19, 2024
Malicious code in quintoandar-logger (npm)
1 compromised version
- Dec 19, 2024
Malware in com.bovinelabs.analyzers
1 compromised version
- Dec 19, 2024
Malware in ripple-blobvault
1 compromised version
- Dec 19, 2024
Malware in quintoandar-logger
1 compromised version
- Dec 19, 2024
Malware in quintoandar-jwt
1 compromised version
- Dec 19, 2024
Malware in coldbox
1 compromised version
- Dec 19, 2024
Malicious code in secret-scanning-custom-notifications (npm)
- Dec 19, 2024
Malicious code in github-webhook-ip-validator (npm)
- Dec 19, 2024
Malicious code in component-detection-action (npm)
- Dec 19, 2024
Malware in codeql-sarif-security-standard-annotator
1 compromised version
- Dec 19, 2024
Malware in kiosk-cli
1 compromised version
- Dec 19, 2024
Malware in graph-studio-billing-contracts
1 compromised version
- Dec 19, 2024
Malware in github-webhook-ip-validator
1 compromised version
- Dec 19, 2024
Malware in secret-scanning-custom-notifications
1 compromised version
- Dec 19, 2024
Malware in component-detection-action
1 compromised version
- Dec 19, 2024
Malware in codeql-extractor-iac-action
1 compromised version
- Dec 19, 2024
Malware in ens-app-v2
1 compromised version
- Dec 19, 2024
Malicious code in mryayaa (npm)
- Dec 19, 2024
Malware in security-alert-watcher
1 compromised version
- Dec 19, 2024
Malware in mryayaa
1 compromised version
- Dec 19, 2024
Malicious code in self-qualification-dialog-sdk (npm)
1 compromised version
- Dec 19, 2024
Malicious code in byted-example (npm)
1 compromised version
- Dec 19, 2024
Malware in byted-example
1 compromised version
- Dec 19, 2024
Malware in self-qualification-dialog-sdk
1 compromised version
- Dec 19, 2024
Malicious code in tools_platform (npm)
1 compromised version
- Dec 19, 2024
Malicious code in tiktok-ui (npm)
1 compromised version
- Dec 19, 2024
Malicious code in df-npm-placeholder (npm)
2 compromised versions
- Dec 19, 2024
Malicious code in client-mpa (npm)
1 compromised version
- Dec 19, 2024
Malicious code in client-data (npm)
1 compromised version
- Dec 19, 2024
Malicious code in client-consent (npm)
1 compromised version
- Dec 19, 2024
Malicious code in client-cloud-phone (npm)
1 compromised version
- Dec 19, 2024
Malicious code in client-analysis (npm)
1 compromised version
- Dec 19, 2024
Malicious code in client-admin (npm)
1 compromised version
- Dec 19, 2024
Malicious code in byted-gulu-ms-logger (npm)
1 compromised version
- Dec 19, 2024
Malware in client-admin
1 compromised version
- Dec 19, 2024
Malware in client-mpa
1 compromised version
- Dec 19, 2024
Malware in client-analysis
1 compromised version
- Dec 19, 2024
Malware in tools_platform
1 compromised version
- Dec 19, 2024
Malware in tiktok-ui
1 compromised version
- Dec 19, 2024
Malware in client-consent
1 compromised version
- Dec 19, 2024
Malware in client-data
1 compromised version
- Dec 19, 2024
Malware in byted-gulu-ms-logger
1 compromised version
- Dec 19, 2024
Malware in df-npm-placeholder
1 compromised version
- Dec 19, 2024
Malware in client-cloud-phone
1 compromised version
- Dec 19, 2024
Malware in buoyant-utils
1 compromised version
- Dec 19, 2024
Malware in support-conversations
1 compromised version
- Dec 19, 2024
Malware in stripe-internal
1 compromised version
- Dec 19, 2024
Malicious code in payment-tx-params-api (npm)
2 compromised versions
- Dec 19, 2024
Malicious code in nextjs-app-router (npm)
1 compromised version
- Dec 19, 2024
Malicious code in eip-681-qr-generator (npm)
2 compromised versions
Page 6473 of 7,308