Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,382 total · sorted newest first- Oct 24, 2024
Malware in nuance-mix
1 compromised version
- Oct 24, 2024
Malicious code in @sixsense/core (npm)
1 compromised version
- Oct 24, 2024
Malicious code in lcnc-app (npm)
4 compromised versions
- Oct 24, 2024
Malicious code in @woody-mrs-potato/utils-banking (npm)
11 compromised versions
- Oct 24, 2024
Malware in ohcm-polymerase
1 compromised version
- Oct 23, 2024
Malicious code in owasp-aasvs-to-readthedocs (npm)
- Oct 23, 2024
Malicious code in git-commit-message-convention (npm)
- Oct 23, 2024
Malware in owasp-aasvs-to-readthedocs
1 compromised version
- Oct 23, 2024
Malware in git-commit-message-convention
1 compromised version
- Oct 23, 2024
Malicious code in sling-sdk (npm)
3 compromised versions
- Oct 22, 2024
Malicious code in ohcm-polymerase (npm)
2 compromised versions
- Oct 22, 2024
Malicious code in pwn2day-shell (npm)
3 compromised versions
- Oct 22, 2024
Malicious code in @wf-wfmfe/pxp (npm)
1 compromised version
- Oct 22, 2024
Malicious code in pplgdfhuighsdfyisfgfd (PyPI)
1 compromised version
- Oct 22, 2024
Malicious code in pplgdfhuighsdfyisfdty2 (PyPI)
1 compromised version
- Oct 22, 2024
Malicious code in pplgdfhuighsdfyisfdty (PyPI)
1 compromised version
- Oct 22, 2024
Malicious code in gal32fjdsbf89hnd (PyPI)
1 compromised version
- Oct 22, 2024
Malicious code in fidnffvvbfhghghhhh (PyPI)
1 compromised version
- Oct 22, 2024
Malicious code in youreallydontwantthispackage2131 (PyPI)
2 compromised versions
- Oct 22, 2024
Malicious code in xcampaigntracker (npm)
1 compromised version
- Oct 22, 2024
Malicious code in mcroutingservice (npm)
1 compromised version
- Oct 22, 2024
Malware in viajemos
1 compromised version
- Oct 22, 2024
Malicious code in semantic-release-commit-rules (npm)
- Oct 22, 2024
Malicious code in module-with-node-gyp (npm)
- Oct 22, 2024
Malicious code in eslint-plugin-no-unsafe (npm)
- Oct 22, 2024
Malware in semantic-release-commit-rules
1 compromised version
- Oct 22, 2024
Malware in module-with-node-gyp
1 compromised version
- Oct 22, 2024
Malware in eslint-plugin-no-unsafe
1 compromised version
- Oct 22, 2024
Malware in module-with-prebuild
1 compromised version
- Oct 22, 2024
Malware in eslint-config-bc
1 compromised version
- Oct 22, 2024
Malware in native-module2
1 compromised version
- Oct 22, 2024
Malware in test-automation-testing
1 compromised version
- Oct 22, 2024
Malicious code in monday-react-quickstart-app (npm)
- Oct 22, 2024
Malware in roblox-creator-docs
1 compromised version
- Oct 22, 2024
Malware in monday-react-quickstart-app
1 compromised version
- Oct 22, 2024
Malicious code in csm-docs (npm)
- Oct 22, 2024
Malware in csm-docs
1 compromised version
- Oct 22, 2024
Malicious code in nuance-mix (npm)
1 compromised version
- Oct 22, 2024
Malicious code in reqstus (npm)
- Oct 22, 2024
Malware in reqstus
1 compromised version
- Oct 21, 2024
Malicious code in sn-flow-client (npm)
4 compromised versions
- Oct 21, 2024
Malicious code in @ng-cat/common (npm)
1 compromised version
- Oct 21, 2024
Malicious code in unity-components (npm)
1 compromised version
- Oct 21, 2024
Malicious code in unity-xlsx (npm)
1 compromised version
- Oct 21, 2024
Malicious code in mybasicauth (npm)
2 compromised versions
- Oct 21, 2024
Malicious code in google-drive-integration (npm)
1 compromised version
- Oct 21, 2024
Malware in google-drive-integration
1 compromised version
- Oct 20, 2024
Malicious code in huangpy (PyPI)
1 compromised version
- Oct 19, 2024
Malicious code in @ttspc/open_center_qf_detail (npm)
2 compromised versions
- Oct 19, 2024
Malicious code in capi-param-builder (npm)
1 compromised version
Page 6523 of 7,308