Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,382 total · sorted newest first- Nov 24, 2024
Malicious code in cometlogger (PyPI)
1 compromised version
- Nov 23, 2024
Malicious code in certain-common-library (npm)
1 compromised version
- Nov 23, 2024
Malicious code in kiosk-cli (npm)
1 compromised version
- Nov 23, 2024
Malicious code in hackbron (npm)
1 compromised version
- Nov 23, 2024
Malicious code in graph-studio-billing-contracts (npm)
1 compromised version
- Nov 23, 2024
Malicious code in @framgia/test (npm)
2 compromised versions
- Nov 23, 2024
Malicious code in codeql-extractor-iac-action (npm)
1 compromised version
- Nov 23, 2024
Malicious code in ens-app-v2 (npm)
1 compromised version
- Nov 22, 2024
Malicious code in codeql-sarif-security-standard-annotator (npm)
1 compromised version
- Nov 22, 2024
Malicious code in security-alert-watcher (npm)
1 compromised version
- Nov 22, 2024
Malicious code in maven-dependency-submission-action (npm)
1 compromised version
- Nov 22, 2024
Malicious code in ap-components-react (npm)
2 compromised versions
- Nov 22, 2024
Malicious code in @ba-ui-toolkit/ba-graphics (npm)
4 compromised versions
- Nov 22, 2024
Malicious code in newpipv3 (PyPI)
1 compromised version
- Nov 22, 2024
Malicious code in webpack-svg-spirit-import (npm)
1 compromised version
- Nov 22, 2024
Malicious code in webpack-support-multi-domain-plugin (npm)
1 compromised version
- Nov 22, 2024
Malicious code in webpack-insert-sentry-plugin (npm)
1 compromised version
- Nov 22, 2024
Malicious code in web_enhance_sap-latest (npm)
1 compromised version
- Nov 22, 2024
Malicious code in web-chat-portal (npm)
1 compromised version
- Nov 22, 2024
Malicious code in blackamerxs (PyPI)
1 compromised version
- Nov 21, 2024
Malicious code in viz_schema (npm)
1 compromised version
- Nov 21, 2024
Malicious code in vite-plugin-unus-api-register (npm)
1 compromised version
- Nov 21, 2024
Malicious code in viewercontext (npm)
1 compromised version
- Nov 21, 2024
Malicious code in uuid-latest (npm)
1 compromised version
- Nov 21, 2024
Malicious code in uss-vod-js-sdk (npm)
1 compromised version
- Nov 21, 2024
Malicious code in upload-to-shopee-cdn (npm)
1 compromised version
- Nov 21, 2024
Malicious code in ts-diagnosis (npm)
1 compromised version
- Nov 21, 2024
Malicious code in my-wallet-backupt-decryption-tool (npm)
1 compromised version
- Nov 21, 2024
Malicious code in storage-atom (npm)
1 compromised version
- Nov 20, 2024
Malicious code in ssc-upload-react (npm)
1 compromised version
- Nov 20, 2024
Malicious code in ssc-ui-react-next (npm)
1 compromised version
- Nov 20, 2024
Malicious code in ssc-ui-react (npm)
1 compromised version
- Nov 20, 2024
Malicious code in ssc-org-vue (npm)
1 compromised version
- Nov 20, 2024
Malicious code in spid-sharing-panel (npm)
1 compromised version
- Nov 20, 2024
Malicious code in spid-gc-ui-leaderboard (npm)
1 compromised version
- Nov 20, 2024
Malicious code in eslint-tools (npm)
1 compromised version
- Nov 20, 2024
Malicious code in npm-cli-release-please (npm)
1 compromised version
- Nov 20, 2024
Malicious code in spex-node-client (npm)
1 compromised version
- Nov 20, 2024
Malicious code in spex-dts (npm)
1 compromised version
- Nov 20, 2024
Malicious code in s-page-legacy (npm)
1 compromised version
- Nov 20, 2024
Malicious code in short-link-sharer (npm)
1 compromised version
- Nov 20, 2024
Malicious code in shopee-ui (npm)
1 compromised version
- Nov 20, 2024
Malicious code in shopee-form-ui (npm)
1 compromised version
- Nov 20, 2024
Malicious code in react-fatigue-dev (npm)
1 compromised version
- Nov 20, 2024
Malicious code in node-elm-stdio (npm)
1 compromised version
- Nov 20, 2024
Malicious code in mangadex-archive-torrent-processor (npm)
1 compromised version
- Nov 20, 2024
Malicious code in filter-engine-ui (npm)
1 compromised version
- Nov 20, 2024
Malicious code in electron-request (npm)
1 compromised version
- Nov 20, 2024
Malicious code in river-build (npm)
1 compromised version
- Nov 20, 2024
Malicious code in galileo_staking (npm)
1 compromised version
Page 6504 of 7,308