Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,382 total · sorted newest first- Dec 15, 2024
Malicious code in 32red-checkout (npm)
1 compromised version
- Dec 15, 2024
Malicious code in 32red-cache (npm)
1 compromised version
- Dec 15, 2024
Malicious code in 32red-auth (npm)
1 compromised version
- Dec 15, 2024
Malicious code in 32red-api-client (npm)
1 compromised version
- Dec 15, 2024
Malicious code in 32red-api (npm)
1 compromised version
- Dec 15, 2024
Malicious code in 32red-analytics (npm)
1 compromised version
- Dec 15, 2024
Malicious code in 32red-admin (npm)
1 compromised version
- Dec 15, 2024
Malicious code in orderly-web (npm)
1 compromised version
- Dec 14, 2024
Malicious code in 000webhost-database (npm)
1 compromised version
- Dec 14, 2024
Malicious code in 000webhost-connect (npm)
1 compromised version
- Dec 14, 2024
Malicious code in 000webhost-cloud (npm)
1 compromised version
- Dec 14, 2024
Malicious code in 000webhost-checkout (npm)
1 compromised version
- Dec 14, 2024
Malicious code in 000webhost-cache (npm)
1 compromised version
- Dec 14, 2024
Malicious code in 000webhost-auth (npm)
1 compromised version
- Dec 14, 2024
Malicious code in 000webhost-api-client (npm)
1 compromised version
- Dec 14, 2024
Malicious code in 000webhost-api (npm)
1 compromised version
- Dec 14, 2024
Malicious code in 000webhost-analytics (npm)
1 compromised version
- Dec 14, 2024
Malicious code in 000webhost-admin (npm)
1 compromised version
- Dec 14, 2024
Malicious code in support-conversations (npm)
1 compromised version
- Dec 14, 2024
Malicious code in stripe-internal (npm)
1 compromised version
- Dec 14, 2024
Malicious code in ml-interactive-data-augmentation (npm)
1 compromised version
- Dec 14, 2024
Malicious code in bounty123ay (npm)
1 compromised version
- Dec 14, 2024
Malicious code in threadfluent (PyPI)
1 compromised version
- Dec 14, 2024
Malicious code in httpfluent (PyPI)
1 compromised version
- Dec 14, 2024
Malicious code in websynapse (PyPI)
1 compromised version
- Dec 14, 2024
Malicious code in rwoka (PyPI)
3 compromised versions
- Dec 14, 2024
Malicious code in solhint-plugin-openzeppelin (npm)
1 compromised version
- Dec 14, 2024
Malicious code in uchiwa-web (npm)
1 compromised version
- Dec 14, 2024
Malicious code in graphql.vscode-graphql-syntax (npm)
1 compromised version
- Dec 14, 2024
Malicious code in resultstore-search-client (npm)
2 compromised versions
- Dec 14, 2024
Malicious code in rsd-monorepo (npm)
1 compromised version
- Dec 14, 2024
Malicious code in openai-realtime-console (npm)
1 compromised version
- Dec 14, 2024
Malicious code in flame-monorepo (npm)
1 compromised version
- Dec 14, 2024
Malicious code in action-mattermost-notify (npm)
1 compromised version
- Dec 14, 2024
Malicious code in mattermost-cloudnative-bootstrapper (npm)
1 compromised version
- Dec 13, 2024
Malicious code in rarible-program-library (npm)
1 compromised version
- Dec 13, 2024
Malicious code in pobreiaia33 (npm)
1 compromised version
- Dec 13, 2024
Malicious code in simulation_service (npm)
1 compromised version
- Dec 13, 2024
Malicious code in pobreiaia22 (npm)
1 compromised version
- Dec 13, 2024
Malicious code in pipedream-curl (npm)
1 compromised version
- Dec 13, 2024
Malicious code in orizuru (npm)
2 compromised versions
- Dec 13, 2024
Malicious code in auth0-lock-webpack (npm)
1 compromised version
- Dec 13, 2024
Malicious code in lana-ws (npm)
1 compromised version
- Dec 13, 2024
Malicious code in casino-luzern-easter-frontend (npm)
1 compromised version
- Dec 13, 2024
Malicious code in free-fire-api (npm)
- Dec 13, 2024
Malware in free-fire-api
1 compromised version
- Dec 13, 2024
Malicious code in imran-spotifydl (npm)
- Dec 13, 2024
Malicious code in imran-servar (npm)
- Dec 13, 2024
Malicious code in imran-downloader-servar (npm)
- Dec 13, 2024
Malicious code in imran-downloader (npm)
Page 6477 of 7,308