Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,382 total · sorted newest first- Nov 12, 2024
Malware in @david-lab/sol-lib
1 compromised version
- Nov 12, 2024
Malicious code in my-rainbowkit-app (npm)
- Nov 12, 2024
Malware in my-rainbowkit-app
1 compromised version
- Nov 12, 2024
Malicious code in coibnase (npm)
- Nov 12, 2024
Malware in coibnase
1 compromised version
- Nov 12, 2024
Malicious code in cryptocmopare (npm)
- Nov 12, 2024
Malware in cryptocmopare
1 compromised version
- Nov 12, 2024
Malicious code in bigto (npm)
- Nov 12, 2024
Malware in bigto
1 compromised version
- Nov 12, 2024
Malicious code in ethers-test (npm)
- Nov 12, 2024
Malicious code in ethers-audit (npm)
- Nov 12, 2024
Malware in ethers-aaa
1 compromised version
- Nov 12, 2024
Malware in ethers-audit
1 compromised version
- Nov 12, 2024
Malware in ethers-test
1 compromised version
- Nov 12, 2024
Malicious code in web3-helpers.js (npm)
- Nov 12, 2024
Malicious code in solana-web3-helpers (npm)
- Nov 12, 2024
Malware in solana-web3-helpers
1 compromised version
- Nov 12, 2024
Malware in web3-helpers.js
1 compromised version
- Nov 12, 2024
Malicious code in web3-bundle-helper.js (npm)
- Nov 12, 2024
Malware in web3-bundle-helper.js
1 compromised version
- Nov 12, 2024
Malicious code in web3-bundle-helpers.js (npm)
- Nov 12, 2024
Malicious code in pumpfun-bundle-helpers.js (npm)
- Nov 12, 2024
Malicious code in launchpad-sdk (npm)
- Nov 12, 2024
Malware in web3-bundle-helpers.js
1 compromised version
- Nov 12, 2024
Malware in launchpad-sdk
1 compromised version
- Nov 12, 2024
Malware in pumpfun-bundle-helpers.js
1 compromised version
- Nov 12, 2024
Malicious code in eslint-plugin-cognitive-complexity (npm)
1 compromised version
- Nov 12, 2024
Malicious code in bytes-guide (npm)
1 compromised version
- Nov 12, 2024
Malicious code in bytes-guides (npm)
1 compromised version
- Nov 12, 2024
Malicious code in magic-porta1 (npm)
1 compromised version
- Nov 12, 2024
Malicious code in vis-trees (npm)
1 compromised version
- Nov 12, 2024
Malicious code in a11-cloud (npm)
1 compromised version
- Nov 12, 2024
Malicious code in backwwii (PyPI)
1 compromised version
- Nov 12, 2024
Malicious code in backwwi (PyPI)
1 compromised version
- Nov 12, 2024
Malicious code in eslint-plugin-add-display-name (npm)
1 compromised version
- Nov 12, 2024
Malicious code in yarn2nix (npm)
2 compromised versions
- Nov 12, 2024
Malicious code in @devlovedz/react-native-camera-kit-example (npm)
1 compromised version
- Nov 11, 2024
Malicious code in eslint-config-finance-web-react (npm)
1 compromised version
- Nov 11, 2024
Malicious code in test-evil-pkg-reverse (npm)
- Nov 11, 2024
Malware in test-evil-pkg-reverse
1 compromised version
- Nov 11, 2024
Malicious code in modlog-archive (npm)
2 compromised versions
- Nov 11, 2024
Malicious code in arkoselabs (npm)
1 compromised version
- Nov 11, 2024
Malicious code in fabrice (PyPI)
- Nov 10, 2024
Malicious code in asn1tool (PyPI)
2 compromised versions
- Nov 10, 2024
Malicious code in @sportdigi/scripts (npm)
9 compromised versions
- Nov 10, 2024
Malicious code in aem-core-react-components (npm)
5 compromised versions
- Nov 10, 2024
Malicious code in careers-job-detail (npm)
1 compromised version
- Nov 10, 2024
Malicious code in @vkplay/shared (npm)
4 compromised versions
- Nov 10, 2024
Malicious code in refocus-sgt-trust1 (npm)
1 compromised version
- Nov 10, 2024
Malicious code in bdc-materials (npm)
1 compromised version
Page 6510 of 7,308