Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,382 total · sorted newest first- Oct 29, 2024
Malware in buildkit-discourse-integration
1 compromised version
- Oct 29, 2024
Malware in nf-gestures
1 compromised version
- Oct 29, 2024
Malware in plain-headless-portal
1 compromised version
- Oct 29, 2024
Malicious code in metadata-attacher (npm)
1 compromised version
- Oct 29, 2024
Malware in metadata-attacher
1 compromised version
- Oct 28, 2024
Malicious code in eslint-plugin-evo (npm)
1 compromised version
- Oct 28, 2024
Malicious code in roboter (npm)
1 compromised version
- Oct 28, 2024
Malicious code in buildkit-discourse-integration (npm)
1 compromised version
- Oct 28, 2024
Malicious code in videoads-util-misc-general (npm)
- Oct 28, 2024
Malicious code in meso-event-queue (npm)
- Oct 28, 2024
Malware in meso-event-queue
1 compromised version
- Oct 28, 2024
Malware in videoads-util-misc-general
1 compromised version
- Oct 28, 2024
Malware in blank-fe
1 compromised version
- Oct 28, 2024
Malicious code in tds-styled-docs (npm)
- Oct 28, 2024
Malware in tds-styled-docs
1 compromised version
- Oct 28, 2024
Malicious code in req-scope (npm)
- Oct 28, 2024
Malicious code in req-ban (npm)
1 compromised version
- Oct 28, 2024
Malware in req-ban
1 compromised version
- Oct 28, 2024
Malware in req-scope
1 compromised version
- Oct 28, 2024
Malicious code in visma-connect-bv (npm)
1 compromised version
- Oct 28, 2024
Malicious code in offensive-security (npm)
1 compromised version
- Oct 28, 2024
Malicious code in luzmo (npm)
1 compromised version
- Oct 28, 2024
Malicious code in ing-friam (npm)
1 compromised version
- Oct 28, 2024
Malicious code in blueconic (npm)
1 compromised version
- Oct 28, 2024
Malware in luzmo
1 compromised version
- Oct 28, 2024
Malware in visma-connect-bv
1 compromised version
- Oct 28, 2024
Malware in offensive-security
1 compromised version
- Oct 28, 2024
Malware in aspera-ui
1 compromised version
- Oct 28, 2024
Malware in tomorrowland
1 compromised version
- Oct 28, 2024
Malware in ing-friam
1 compromised version
- Oct 28, 2024
Malware in blueconic
1 compromised version
- Oct 28, 2024
Malware in arangodb
1 compromised version
- Oct 28, 2024
Malicious code in selfcord-v14 (npm)
- Oct 28, 2024
Malicious code in selfcord-js-v14 (npm)
- Oct 28, 2024
Malware in selfcord-js-v14
1 compromised version
- Oct 28, 2024
Malware in selfcord-v14
1 compromised version
- Oct 27, 2024
Malicious code in kekiktaban (PyPI)
2 compromised versions
- Oct 27, 2024
Malicious code in oneui.angular (npm)
1 compromised version
- Oct 26, 2024
Malicious code in edtttsenuity (npm)
1 compromised version
- Oct 26, 2024
Malicious code in axum-live-view (npm)
1 compromised version
- Oct 24, 2024
Malicious code in wasabicons (npm)
1 compromised version
- Oct 24, 2024
Malicious code in acl-icon-font (npm)
1 compromised version
- Oct 24, 2024
Malware in direct_access_theme
1 compromised version
- Oct 24, 2024
Malicious code in dexter-angular-app (npm)
1 compromised version
- Oct 24, 2024
Malware in dexter-angular-app
1 compromised version
- Oct 24, 2024
Malicious code in viem-aa-sdk-compatible (npm)
- Oct 24, 2024
Malicious code in ak-docgen (npm)
- Oct 24, 2024
Malware in ak-docgen
1 compromised version
- Oct 24, 2024
Malware in capi-param-builder
1 compromised version
- Oct 24, 2024
Malware in viem-aa-sdk-compatible
1 compromised version
Page 6522 of 7,308