Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,382 total · sorted newest first- Nov 26, 2024
Malicious code in kraken-wallet-network-icons (npm)
1 compromised version
- Nov 26, 2024
Malicious code in debugr1 (npm)
1 compromised version
- Nov 26, 2024
Malware in debugr1
1 compromised version
- Nov 26, 2024
Malware in kraken-wallet-network-icons
1 compromised version
- Nov 26, 2024
Malicious code in eager-blog (npm)
1 compromised version
- Nov 26, 2024
Malicious code in dep-validator-cli (npm)
2 compromised versions
- Nov 26, 2024
Malicious code in cs-shared-component-tools (npm)
1 compromised version
- Nov 26, 2024
Malicious code in config-sdk-nodejs (npm)
1 compromised version
- Nov 26, 2024
Malicious code in commitlint-plugin-rules-an (npm)
2 compromised versions
- Nov 26, 2024
Malicious code in commitlint-plugin-marketing-rules (npm)
2 compromised versions
- Nov 26, 2024
Malware in commitlint-plugin-jira-type-rules
1 compromised version
- Nov 26, 2024
Malware in cs-shared-component-tools
1 compromised version
- Nov 26, 2024
Malware in commitlint-plugin-marketing-rules
1 compromised version
- Nov 26, 2024
Malware in dep-validator-cli
1 compromised version
- Nov 26, 2024
Malware in commitlint-plugin-rules-an
1 compromised version
- Nov 26, 2024
Malware in cs-deploy-helper
1 compromised version
- Nov 26, 2024
Malware in cs-base-component
1 compromised version
- Nov 26, 2024
Malware in eager-blog
1 compromised version
- Nov 26, 2024
Malware in config-sdk-nodejs
1 compromised version
- Nov 26, 2024
Malware in dre-example
1 compromised version
- Nov 26, 2024
Malicious code in eslint-config-seller (npm)
2 compromised versions
- Nov 26, 2024
Malicious code in eslint-config-merchant-web (npm)
2 compromised versions
- Nov 26, 2024
Malicious code in eslint-config-merchant-rn (npm)
2 compromised versions
- Nov 26, 2024
Malware in eslint-config-merchant-web
1 compromised version
- Nov 26, 2024
Malware in eslint-config-seller
1 compromised version
- Nov 26, 2024
Malware in eslint-config-finance-node
1 compromised version
- Nov 26, 2024
Malware in eslint-config-merchant-rn
1 compromised version
- Nov 26, 2024
Malware in eslint-config-games
1 compromised version
- Nov 26, 2024
Malware in eslint-config-finance-rn
1 compromised version
- Nov 26, 2024
Malicious code in eds-charts-react (npm)
2 compromised versions
- Nov 26, 2024
Malware in eds-charts
1 compromised version
- Nov 26, 2024
Malware in eslint-config-finance
1 compromised version
- Nov 26, 2024
Malware in eds-vue
1 compromised version
- Nov 26, 2024
Malware in eds-charts-react
1 compromised version
- Nov 26, 2024
Malware in osm-legal-speed
1 compromised version
- Nov 26, 2024
Malware in team-plain
1 compromised version
- Nov 26, 2024
Malicious code in nativeapp-bridge (npm)
2 compromised versions
- Nov 26, 2024
Malware in wf-dbd-react-ui
1 compromised version
- Nov 26, 2024
Malware in nativeapp-bridge
1 compromised version
- Nov 26, 2024
Malware in wfui-digital-core
1 compromised version
- Nov 26, 2024
Malicious code in grapql-yoga (npm)
- Nov 26, 2024
Malware in grapql-yoga
1 compromised version
- Nov 26, 2024
Malware in emtoolsjs
1 compromised version
- Nov 26, 2024
Malicious code in undc (npm)
- Nov 26, 2024
Malware in undc
1 compromised version
- Nov 26, 2024
Malicious code in pmto (npm)
- Nov 26, 2024
Malware in pmto
1 compromised version
- Nov 26, 2024
Malicious code in n-http-proxy (npm)
- Nov 26, 2024
Malware in n-http-proxy
1 compromised version
- Nov 26, 2024
Malicious code in icf-react-components (npm)
Page 6501 of 7,308