Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,382 total · sorted newest first- Dec 8, 2024
Malicious code in acp-docs (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in acces-react (npm)
1 compromised version
- Dec 8, 2024
Malicious code in ac-analytics (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in a39a85e7 (npm)
1 compromised version
- Dec 8, 2024
Malicious code in a111y-cloud (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @wf-wfmfe/sdk (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @volcenjine/tos-sdk (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @volcenjine/rtc (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @volcenjine/openapi (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @thd-eux/theme-mui (npm)
4 compromised versions
- Dec 8, 2024
Malicious code in @service-and-repairs/awpintegrationlib (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in @saleswhale/barnacle (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @rambler-help/shared (npm)
30 compromised versions
- Dec 8, 2024
Malicious code in @platform-ui-kit/components-library-react (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @mysas/shared (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @marfeel/eslint-config-js (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @linx-ui/payatu (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @leseo/book-viewer (npm)
6 compromised versions
- Dec 8, 2024
Malicious code in @isfe-common/image-minimizer (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @im-dims/baileys (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @iherb-react-environment/config (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @iherb-payment/pages (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in @facetca/facet-ruler (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @facetca/calculator (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @douinfe/semi-animation-react (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @douinfe/semi-adimation (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @douinfe/create-semi-d2c-plugin (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in @conundra/components-frontend (npm)
3 compromised versions
- Dec 8, 2024
Malicious code in @cdh-data-portal-theme/build (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in @cawraytestorg/packagetest (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @bytedanc/mona-max (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @bytedanc/mona-client-web (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @bytedanc-ad/market-ui-vue2 (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @aws-sdk-examples/libs (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in @arkangel-ai/arkangel-ai (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @agilent/web-icons (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @agilent/awf-wc (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @agilent/awf-styles (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @afound/common (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in fake-emitter-no-schema (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in chronos-web-ui (npm)
1 compromised version
- Dec 8, 2024
Malicious code in tripadvisor-npm (npm)
3 compromised versions
- Dec 8, 2024
Malicious code in nextcloud123 (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in nextcloud2 (npm)
1 compromised version
- Dec 8, 2024
Malicious code in yelp-lib (npm)
1 compromised version
- Dec 8, 2024
Malicious code in @chia-networrk/api (npm)
6 compromised versions
- Dec 8, 2024
Malicious code in bbbx (npm)
1 compromised version
- Dec 8, 2024
Malicious code in bbb-logging (npm)
2 compromised versions
- Dec 8, 2024
Malicious code in less-rhino (npm)
1 compromised version
- Dec 8, 2024
Malicious code in jquery.slideviewer (npm)
1 compromised version
Page 6486 of 7,308