Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,337 total · sorted newest first- Oct 16, 2024
Malicious code in gp-analytics (npm)
1 compromised version
- Oct 16, 2024
Malicious code in glimmerer (npm)
1 compromised version
- Oct 16, 2024
Malicious code in github-loader (npm)
1 compromised version
- Oct 16, 2024
Malicious code in gioenduek (npm)
1 compromised version
- Oct 16, 2024
Malicious code in get-hydrated-cms-data (npm)
1 compromised version
- Oct 16, 2024
Malicious code in genuine-azure-swordtail (npm)
1 compromised version
- Oct 16, 2024
Malicious code in generalytics (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in gcptestpackagepoc (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in full-crimson-shark (npm)
1 compromised version
- Oct 16, 2024
Malicious code in fs-read-file (npm)
1 compromised version
- Oct 16, 2024
Malicious code in frozen-violet-sailfish (npm)
1 compromised version
- Oct 16, 2024
Malicious code in freebsd-x64 (npm)
1 compromised version
- Oct 16, 2024
Malicious code in flormar-global (npm)
1 compromised version
- Oct 16, 2024
Malicious code in flarer (npm)
1 compromised version
- Oct 16, 2024
Malicious code in flaky-coffee-wren (npm)
1 compromised version
- Oct 16, 2024
Malicious code in feature-targeting (npm)
1 compromised version
- Oct 16, 2024
Malicious code in fb-group (npm)
1 compromised version
- Oct 16, 2024
Malicious code in fatest-distube (npm)
1 compromised version
- Oct 16, 2024
Malicious code in far-teal-platypus (npm)
1 compromised version
- Oct 16, 2024
Malicious code in far-gray-pike (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-paragraph (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-image (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-horizontal-rule (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-heading (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-hard-break (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-gapcursor (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-floating-menu (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-dropcursor (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-document (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-bullet-list (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-bubble-menu (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-bold (npm)
1 compromised version
- Oct 16, 2024
Malicious code in extension-blockquote (npm)
1 compromised version
- Oct 16, 2024
Malicious code in exporter-trace-otlp-proto (npm)
1 compromised version
- Oct 16, 2024
Malicious code in exporter-trace-otlp-http (npm)
1 compromised version
- Oct 16, 2024
Malicious code in export-gltf (npm)
1 compromised version
- Oct 16, 2024
Malicious code in experimental-purple-walrus (npm)
1 compromised version
- Oct 16, 2024
Malicious code in executor-http (npm)
1 compromised version
- Oct 16, 2024
Malicious code in example-gtm (npm)
1 compromised version
- Oct 16, 2024
Malicious code in ewueirit (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eventstream-serde-universal (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eventstream-serde-config-resolver (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eventstream-serde-browser (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eventstream-codec (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eum-veritatis-placeat (npm)
1 compromised version
- Oct 16, 2024
Malicious code in ethnic-purple-iguana (npm)
1 compromised version
- Oct 16, 2024
Malicious code in esse-praesentium-eligendi (npm)
1 compromised version
- Oct 16, 2024
Malicious code in eslint-v7 (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in esbuild-plugin-global-externals (npm)
1 compromised version
- Oct 16, 2024
Malicious code in env-debug-logger (npm)
3 compromised versions
Page 6535 of 7,307