Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,337 total · sorted newest first- Oct 16, 2024
Malicious code in agora-rtc-web (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in aggregate-rose-booby (npm)
1 compromised version
- Oct 16, 2024
Malicious code in acceptable-purple-sheep (npm)
1 compromised version
- Oct 16, 2024
Malicious code in acceptable-emerald-ladybug (npm)
1 compromised version
- Oct 16, 2024
Malicious code in able-lime-albatross (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @zva/web (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in @zhiend989/asdfqwer (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/voidray-sdk-addon-media-recorder (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/voidray-sdk-addon-map-file (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/voidray-sdk-addon-disk-image-write (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/voidray-sdk-addon-disk-image-browse (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/voidray-sdk-addon-audio (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/voidray-sdk (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/asdfqwer (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @vertiv-co/adx-jetstream-util (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @usaa-grp-inf-presentation/usaa-tw-base (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in @usaa-grp-inf-presentation/usaa-tw-apps (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @usaa-grp-inf-presentation/browserslist-config-usaa (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @taxify/trippricingopt (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in @taxify/taxify-code-utils (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in @taxify/redux-session (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in @taxify/price-estimate-helper-models (npm)
3 compromised versions
- Oct 16, 2024
Malicious code in @taxify/nodejs-common (npm)
2 compromised versions
- Oct 16, 2024
Malicious code in @snapchat-web-calling/app (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @shwetkhushi/field-group (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @pcid/client-request-builder (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @no1xsalman/dompubsub (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @mwrc/a (npm)
4 compromised versions
- Oct 16, 2024
Malicious code in @msaaqcom/masaqtest (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @iceberg-react/test-package (npm)
4 compromised versions
- Oct 16, 2024
Malicious code in @galaxy-joy/loy.api.core (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @frontend-performance/image-lazy-loading (npm)
1 compromised version
- Oct 16, 2024
Malicious code in @daimler-rcms/api-client (npm)
1 compromised version
- Oct 16, 2024
Malicious code in ship_sleepnpm-tool (npm)
1 compromised version
- Oct 16, 2024
Malicious code in shenyuan (npm)
1 compromised version
- Oct 16, 2024
Malicious code in aria-web-telemetry (npm)
17 compromised versions
- Oct 16, 2024
Malware in aria-web-telemetry
1 compromised version
- Oct 15, 2024
Malicious code in aspera-ui (npm)
1 compromised version
- Oct 15, 2024
Malicious code in tomorrowland (npm)
1 compromised version
- Oct 15, 2024
Malicious code in maliciouspackage (PyPI)
5 compromised versions
- Oct 15, 2024
Malicious code in @coyo/ui (npm)
2 compromised versions
- Oct 15, 2024
Malicious code in viajemos (npm)
3 compromised versions
- Oct 14, 2024
Malicious code in snowday (npm)
1 compromised version
- Oct 14, 2024
Malicious code in shmam-mw-test-3-test-package-3 (npm)
- Oct 14, 2024
Malware in shmam-mw-test-3-test-package-3
1 compromised version
- Oct 14, 2024
Malicious code in lwplugin (PyPI)
1 compromised version
- Oct 14, 2024
Malicious code in blank-fe (npm)
1 compromised version
- Oct 14, 2024
Malicious code in eslint-plugin-rossum (npm)
1 compromised version
- Oct 14, 2024
Malicious code in luna-paysure (PyPI)
5 compromised versions
- Oct 14, 2024
Malicious code in redis-oracle (npm)
4 compromised versions
Page 6538 of 7,307