Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,382 total · sorted newest first- Nov 4, 2024
Malicious code in puppeteer-extra-stealth (npm)
- Nov 4, 2024
Malware in puppeteer-extra-stealth
1 compromised version
- Nov 4, 2024
Malicious code in puppeteerpluginstealth (npm)
- Nov 4, 2024
Malware in puppeteerpluginstealth
1 compromised version
- Nov 4, 2024
Malware in directv
1 compromised version
- Nov 3, 2024
Malicious code in finsys-webcomponent (npm)
1 compromised version
- Nov 3, 2024
Malicious code in mina-payout (npm)
1 compromised version
- Nov 3, 2024
Malicious code in appdynamics-protobuf (npm)
1 compromised version
- Nov 3, 2024
Malicious code in appdynamics-libagent-napi (npm)
1 compromised version
- Nov 3, 2024
Malicious code in appdynamics-zmq (npm)
1 compromised version
- Nov 3, 2024
Malicious code in appdynamics-native (npm)
1 compromised version
- Nov 3, 2024
Malicious code in @toloka-tb/core (npm)
2 compromised versions
- Nov 3, 2024
Malicious code in @gthwebdev/ui-tooltip (npm)
1 compromised version
- Nov 3, 2024
Malicious code in bridgetrack (npm)
1 compromised version
- Nov 3, 2024
Malicious code in sc-libraries (npm)
1 compromised version
- Nov 3, 2024
Malicious code in sc-meta-layer (npm)
1 compromised version
- Nov 3, 2024
Malicious code in sc-pattern-library (npm)
1 compromised version
- Nov 2, 2024
Malicious code in evernote-thrift (npm)
2 compromised versions
- Nov 2, 2024
Malicious code in @captivateiq/random (npm)
1 compromised version
- Nov 2, 2024
Malicious code in @captivateiq/handsontable-ciq (npm)
5 compromised versions
- Nov 2, 2024
Malicious code in @captivateiq/events (npm)
5 compromised versions
- Nov 2, 2024
Malicious code in rentez-docs (npm)
5 compromised versions
- Nov 2, 2024
Malicious code in vpsnet-website (npm)
1 compromised version
- Nov 2, 2024
Malicious code in @wf-wfria/pioneer-core (npm)
3 compromised versions
- Nov 1, 2024
Malicious code in byted_service_env (npm)
1 compromised version
- Nov 1, 2024
Malicious code in creative_design_client (npm)
1 compromised version
- Nov 1, 2024
Malicious code in byted-uploader (npm)
1 compromised version
- Nov 1, 2024
Malicious code in wawawa123s12sd (npm)
1 compromised version
- Nov 1, 2024
Malicious code in kakakakka (npm)
1 compromised version
- Nov 1, 2024
Malicious code in abdef (npm)
1 compromised version
- Nov 1, 2024
Malicious code in ksjdksdks (npm)
1 compromised version
- Nov 1, 2024
Malware in hedgedoc-api
1 compromised version
- Oct 31, 2024
Malicious code in @lottiefiles/lottie-player (npm)
3 compromised versions
- Oct 31, 2024
Malicious code in allocations-ui (npm)
1 compromised version
- Oct 31, 2024
Malicious code in @amagioss/js-timecode (npm)
1 compromised version
- Oct 31, 2024
Malicious code in blossom-flex-ui (npm)
1 compromised version
- Oct 31, 2024
Malicious code in gyaani (npm)
- Oct 31, 2024
Malware in gyaani
1 compromised version
- Oct 31, 2024
Malware in toolspacks
1 compromised version
- Oct 31, 2024
Malware in ship_sleepnpm-tool
1 compromised version
- Oct 31, 2024
Malicious code in freshchange (npm)
1 compromised version
- Oct 31, 2024
Malware in freshchange
1 compromised version
- Oct 31, 2024
Malware in custom-ui-extension-template
1 compromised version
- Oct 31, 2024
Malware in dragonhack-workshop
1 compromised version
- Oct 31, 2024
Malware in celtra-auto-exporter
1 compromised version
- Oct 30, 2024
Malicious code in cms-core-redux (npm)
1 compromised version
- Oct 30, 2024
Malicious code in hmac2 (PyPI)
3 compromised versions
- Oct 30, 2024
Malicious code in cms-ti-components (npm)
1 compromised version
- Oct 30, 2024
Malicious code in cms-hpti-components (npm)
1 compromised version
- Oct 30, 2024
Malicious code in directv (npm)
1 compromised version
Page 6520 of 7,308