Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,382 total · sorted newest first- Nov 27, 2024
Malicious code in tracking-wtf (npm)
1 compromised version
- Nov 27, 2024
Malicious code in ssc-mobile-ui-react (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in shopee-ui-react4 (npm)
1 compromised version
- Nov 27, 2024
Malicious code in onboarding-ops (npm)
2 compromised versions
- Nov 27, 2024
Malware in seller-listing-rn-lib
1 compromised version
- Nov 27, 2024
Malware in seller-address-common
1 compromised version
- Nov 27, 2024
Malware in react-dom-16
1 compromised version
- Nov 27, 2024
Malware in ssc-mobile-ui-react
1 compromised version
- Nov 27, 2024
Malware in polaris-report
1 compromised version
- Nov 27, 2024
Malware in shopee-ui-react4
1 compromised version
- Nov 27, 2024
Malware in web_enhance_sap-stable
1 compromised version
- Nov 27, 2024
Malware in dapp-test-runner
1 compromised version
- Nov 27, 2024
Malware in tracking-wtf
1 compromised version
- Nov 27, 2024
Malware in rn-i18n-extensions
1 compromised version
- Nov 27, 2024
Malware in onboarding-ops
1 compromised version
- Nov 27, 2024
Malicious code in json-tree-preview (npm)
1 compromised version
- Nov 27, 2024
Malicious code in fulfillment-portal-common (npm)
2 compromised versions
- Nov 27, 2024
Malicious code in eslint-plugin-locale (npm)
1 compromised version
- Nov 27, 2024
Malware in ads-common-utils
1 compromised version
- Nov 27, 2024
Malware in json-tree-preview
1 compromised version
- Nov 27, 2024
Malware in mdap-cli
1 compromised version
- Nov 27, 2024
Malware in fulfillment-portal-common
1 compromised version
- Nov 27, 2024
Malware in eslint-plugin-locale
1 compromised version
- Nov 27, 2024
Malicious code in xenoupdater (npm)
- Nov 27, 2024
Malware in xenoupdater
1 compromised version
- Nov 27, 2024
Malicious code in updsolara (npm)
1 compromised version
- Nov 27, 2024
Malicious code in updasolara (npm)
1 compromised version
- Nov 27, 2024
Malware in updsolara
1 compromised version
- Nov 27, 2024
Malware in updasolara
1 compromised version
- Nov 27, 2024
Malicious code in malicious_sleep_package (npm)
- Nov 27, 2024
Malware in malicious_sleep_package
1 compromised version
- Nov 27, 2024
Malware in tcms-malicious-package-test-1
1 compromised version
- Nov 27, 2024
Malicious code in string-process-mate (npm)
1 compromised version
- Nov 27, 2024
Malware in string-process-mate
1 compromised version
- Nov 26, 2024
Malicious code in etherscancontracthandler (npm)
5 compromised versions
- Nov 26, 2024
Malware in etherscancontracthandler
1 compromised version
- Nov 26, 2024
Malware in comcast.github.io
1 compromised version
- Nov 26, 2024
Malicious code in kraken-wallet-cryptoicons (npm)
1 compromised version
- Nov 26, 2024
Malicious code in babel-plugin-error-context (npm)
1 compromised version
- Nov 26, 2024
Malware in babel-plugin-error-context
1 compromised version
- Nov 26, 2024
Malware in kraken-wallet-cryptoicons
1 compromised version
- Nov 26, 2024
Malware in bnppf-font-icons
1 compromised version
- Nov 26, 2024
Malicious code in uid2-publisher (npm)
1 compromised version
- Nov 26, 2024
Malicious code in tc-portal (npm)
1 compromised version
- Nov 26, 2024
Malware in language-matlab
1 compromised version
- Nov 26, 2024
Malware in nodepaysafesdk
1 compromised version
- Nov 26, 2024
Malware in paysafe-ia-v1-portal-backoffice-fe
1 compromised version
- Nov 26, 2024
Malware in matlab-language-server
1 compromised version
- Nov 26, 2024
Malware in nuclei-action
1 compromised version
- Nov 26, 2024
Malware in matitanium
1 compromised version
Page 6500 of 7,308