Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,382 total · sorted newest first- Dec 9, 2024
Malicious code in dependency-confusion-poc777 (npm)
1 compromised version
- Dec 8, 2024
Malicious code in danum (npm)
1 compromised version
- Dec 8, 2024
Malicious code in cyepoc (npm)
1 compromised version
- Dec 8, 2024
Malicious code in crypto-latest (npm)
1 compromised version
- Dec 8, 2024
Malicious code in create-semi-d2c-plugin (npm)
1 compromised version
- Dec 8, 2024
Malicious code in composed-react-app (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in complire (npm)
1 compromised version
- Dec 8, 2024
Malicious code in complier (npm)
1 compromised version
- Dec 8, 2024
Malicious code in compilre (npm)
1 compromised version
- Dec 8, 2024
Malicious code in com.nethereum.unity (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in chime-ui (npm)
3 compromised versions
- Dec 8, 2024
Malicious code in check-deps-version-consistency (npm)
1 compromised version
- Dec 8, 2024
Malicious code in check-deps-ver-consistency (npm)
1 compromised version
- Dec 8, 2024
Malicious code in check-dependency-ver-consistency (npm)
1 compromised version
- Dec 8, 2024
Malicious code in ccs-react-lib (npm)
4 compromised versions
- Dec 8, 2024
Malicious code in ccb-app-ui-service (npm)
6 compromised versions
- Dec 8, 2024
Malicious code in cap1-modules (npm)
1 compromised version
- Dec 8, 2024
Malicious code in c1f212x412haxer (npm)
1 compromised version
- Dec 8, 2024
Malicious code in c0re-jss (npm)
1 compromised version
- Dec 8, 2024
Malicious code in byteir (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bytedance-i18n-hooks (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bytedance-i18n-ghook (npm)
1 compromised version
- Dec 8, 2024
Malicious code in byted-guides (npm)
1 compromised version
- Dec 8, 2024
Malicious code in byted-guide (npm)
1 compromised version
- Dec 8, 2024
Malicious code in byte-guides (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bloxbootstrap (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bitdefender-sitemap-creator (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in bioma (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bigcommerce-monit (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bc-loading (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bababababa (npm)
1 compromised version
- Dec 8, 2024
Malicious code in b2bneo (npm)
1 compromised version
- Dec 8, 2024
Malicious code in awf-styles (npm)
1 compromised version
- Dec 8, 2024
Malicious code in autoball (npm)
1 compromised version
- Dec 8, 2024
Malicious code in asdasssd-hello-world (npm)
1 compromised version
- Dec 8, 2024
Malicious code in asdassd-hello-world (npm)
1 compromised version
- Dec 8, 2024
Malicious code in asdasd-hello-world (npm)
1 compromised version
- Dec 8, 2024
Malicious code in asanablog (npm)
1 compromised version
- Dec 8, 2024
Malicious code in arkangel-ai (npm)
1 compromised version
- Dec 8, 2024
Malicious code in apply-brand-color (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in app-webbridge (npm)
1 compromised version
- Dec 8, 2024
Malicious code in apc-publish (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in apc-admin-utils (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in antibyfron (npm)
1 compromised version
- Dec 8, 2024
Malicious code in another-query-parser (npm)
5 compromised versions
- Dec 8, 2024
Malicious code in aiglife.episerver.web (npm)
1 compromised version
- Dec 8, 2024
Malicious code in agilent.pl29.voldemort.frontend (npm)
1 compromised version
- Dec 8, 2024
Malicious code in admin-upload-common (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in active-win1 (npm)
1 compromised version
- Dec 8, 2024
Malicious code in acribus-core (npm)
2 compromised versions
Page 6485 of 7,308