Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,337 total · sorted newest first- Oct 16, 2024
Malicious code in region-config-resolver (npm)
1 compromised version
- Oct 16, 2024
Malicious code in real-aquamarine-bird (npm)
1 compromised version
- Oct 16, 2024
Malicious code in react-visually-hidden (npm)
1 compromised version
- Oct 16, 2024
Malicious code in react-use-notify (npm)
1 compromised version
- Oct 16, 2024
Malicious code in react-separator (npm)
1 compromised version
- Oct 16, 2024
Malicious code in react-native-playstation (npm)
1 compromised version
- Oct 16, 2024
Malicious code in react-native-community (npm)
1 compromised version
- Oct 16, 2024
Malicious code in react-and-rockets (npm)
1 compromised version
- Oct 16, 2024
Malicious code in racial-crimson-lark (npm)
1 compromised version
- Oct 16, 2024
Malicious code in quivoir (npm)
1 compromised version
- Oct 16, 2024
Malicious code in quae-dolore-nostrum (npm)
1 compromised version
- Oct 16, 2024
Malicious code in qowuer (npm)
1 compromised version
- Oct 16, 2024
Malicious code in qeiorr (npm)
1 compromised version
- Oct 16, 2024
Malicious code in proposed-apricot-lark (npm)
1 compromised version
- Oct 16, 2024
Malicious code in propagator-jaeger (npm)
1 compromised version
- Oct 16, 2024
Malicious code in probable-maroon-roundworm (npm)
1 compromised version
- Oct 16, 2024
Malicious code in princedevmt-test-2 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in princedevmt-test-1 (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in princedevmt-test (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in primitive-ivory-sole (npm)
1 compromised version
- Oct 16, 2024
Malicious code in preview-api (npm)
1 compromised version
- Oct 16, 2024
Malicious code in preferred-copper-manatee (npm)
1 compromised version
- Oct 16, 2024
Malicious code in preact-debug (npm)
1 compromised version
- Oct 16, 2024
Malicious code in pocblablacat (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plumerie (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-warn-if-update-available (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-vue-jsx (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-unicode-sets-regex (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-unicode-property-regex (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-private-property-in-object (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-private-methods (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-optional-chaining (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-object-rest-spread (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-numeric-separator (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-logical-assignment-operators (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-export-namespace-from (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-dynamic-import (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-class-static-block (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-transform-async-generator-functions (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-throttling (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-syntax-unicode-sets-regex (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-syntax-import-attributes (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-not-found (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-help (npm)
1 compromised version
- Oct 16, 2024
Malicious code in plugin-bugfix-v8-static-class-fields-redefine-readonly (npm)
1 compromised version
- Oct 16, 2024
Malicious code in payouts-link-ui (npm)
1 compromised version
- Oct 16, 2024
Malicious code in participant-register-purchase-alias (npm)
1 compromised version
- Oct 16, 2024
Malicious code in paddle-subscription (npm)
1 compromised version
- Oct 16, 2024
Malicious code in outstanding-yellow-jackal (npm)
1 compromised version
- Oct 16, 2024
Malicious code in otlp-transformer (npm)
1 compromised version
Page 6532 of 7,307