Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,382 total · sorted newest first- Dec 17, 2024
Malware in pacbot-spa
1 compromised version
- Dec 17, 2024
Malware in dex12212
1 compromised version
- Dec 17, 2024
Malware in majidalfuttaim
1 compromised version
- Dec 17, 2024
Malware in dextester123
1 compromised version
- Dec 17, 2024
Malware in supply-chain-planner
1 compromised version
- Dec 17, 2024
Malicious code in windows-version-check (npm)
3 compromised versions
- Dec 17, 2024
Malicious code in windows-confirm (npm)
- Dec 17, 2024
Malicious code in solara-config (npm)
2 compromised versions
- Dec 17, 2024
Malicious code in downloadsolara (npm)
- Dec 17, 2024
Malware in downloadsolara
1 compromised version
- Dec 17, 2024
Malware in windows-confirm
1 compromised version
- Dec 17, 2024
Malware in windows-version-check
1 compromised version
- Dec 17, 2024
Malware in solara-config
1 compromised version
- Dec 17, 2024
Malicious code in vue-cli-plugin-lint-staged (npm)
1 compromised version
- Dec 17, 2024
Malicious code in vercel-repros (npm)
1 compromised version
- Dec 17, 2024
Malicious code in tsanjint (npm)
2 compromised versions
- Dec 17, 2024
Malicious code in @monkey-tilt/ui (npm)
2 compromised versions
- Dec 16, 2024
Malicious code in @saferpay/eslint-config-base (npm)
1 compromised version
- Dec 16, 2024
Malicious code in @saferpay/eslint-config-react (npm)
1 compromised version
- Dec 16, 2024
Malicious code in @saferpay/components (npm)
1 compromised version
- Dec 16, 2024
Malicious code in @saferpay/react-library (npm)
1 compromised version
- Dec 16, 2024
Malicious code in @saferpay/logging (npm)
2 compromised versions
- Dec 16, 2024
Malicious code in brodocs (npm)
1 compromised version
- Dec 16, 2024
Malicious code in microsoft.applicationinsights.windowsapps (npm)
1 compromised version
- Dec 16, 2024
Malicious code in start-decent (npm)
1 compromised version
- Dec 16, 2024
Malicious code in microsoft.applicationinsights.persistencechannel (npm)
1 compromised version
- Dec 16, 2024
Malicious code in pokedex-vue3 (npm)
1 compromised version
- Dec 16, 2024
Malicious code in shoaib-demo (npm)
1 compromised version
- Dec 16, 2024
Malicious code in ifood-github-io (npm)
1 compromised version
- Dec 16, 2024
Malicious code in label-merge-conflicts-action (npm)
1 compromised version
- Dec 16, 2024
Malicious code in spacexstats (npm)
1 compromised version
- Dec 16, 2024
Malicious code in asymmetric-key-generator (npm)
1 compromised version
- Dec 16, 2024
Malicious code in web3-docs (npm)
1 compromised version
- Dec 16, 2024
Malicious code in react-vis-website (npm)
1 compromised version
- Dec 16, 2024
Malicious code in presudo-generate (PyPI)
1 compromised version
- Dec 16, 2024
Malicious code in noway-back (PyPI)
1 compromised version
- Dec 16, 2024
Malicious code in langer-updater (PyPI)
6 compromised versions
- Dec 16, 2024
Malicious code in lan-clean (PyPI)
2 compromised versions
- Dec 16, 2024
Malicious code in code-tracker (PyPI)
1 compromised version
- Dec 16, 2024
Malicious code in code-suggester (PyPI)
1 compromised version
- Dec 16, 2024
Malicious code in code-beautifyer (PyPI)
1 compromised version
- Dec 16, 2024
Malicious code in clean-packager (PyPI)
1 compromised version
- Dec 16, 2024
Malicious code in zip-me (PyPI)
1 compromised version
- Dec 16, 2024
Malicious code in ui_next (npm)
1 compromised version
- Dec 15, 2024
Malicious code in nrql-tutorial (npm)
2 compromised versions
- Dec 15, 2024
Malicious code in bsc-genesis-contract (npm)
1 compromised version
- Dec 15, 2024
Malicious code in questdb-console (npm)
1 compromised version
- Dec 15, 2024
Malicious code in 32red-database (npm)
1 compromised version
- Dec 15, 2024
Malicious code in 32red-connect (npm)
1 compromised version
- Dec 15, 2024
Malicious code in 32red-cloud (npm)
1 compromised version
Page 6476 of 7,308