Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,337 total · sorted newest first- Oct 10, 2024
Malware in 1-2-customization-basic-format
1 compromised version
- Oct 10, 2024
Malware in vtadmin
1 compromised version
- Oct 10, 2024
Malicious code in xs2aframe (npm)
1 compromised version
- Oct 10, 2024
Malicious code in weekopendays (npm)
1 compromised version
- Oct 10, 2024
Malicious code in ig-release-aws (npm)
- Oct 10, 2024
Malicious code in foldl (npm)
1 compromised version
- Oct 10, 2024
Malicious code in dynsegmentationserv (npm)
- Oct 10, 2024
Malware in xs2aframe
1 compromised version
- Oct 10, 2024
Malware in foldl
1 compromised version
- Oct 10, 2024
Malware in dijit-legacy-requires
1 compromised version
- Oct 10, 2024
Malware in node-jaws
1 compromised version
- Oct 10, 2024
Malware in notrealpackage-blac
1 compromised version
- Oct 10, 2024
Malware in ig-release-aws
1 compromised version
- Oct 10, 2024
Malware in alertsorchestration-paypal
1 compromised version
- Oct 10, 2024
Malware in weekopendays
1 compromised version
- Oct 10, 2024
Malware in visa-ui-angular
1 compromised version
- Oct 10, 2024
Malware in dynsegmentationserv
1 compromised version
- Oct 10, 2024
Malicious code in rdservices (npm)
- Oct 10, 2024
Malware in rdservices
1 compromised version
- Oct 10, 2024
Malware in case-result-reporter
1 compromised version
- Oct 10, 2024
Malicious code in numeral-light (npm)
- Oct 10, 2024
Malicious code in getsafe-interview (npm)
- Oct 10, 2024
Malicious code in briefer (npm)
- Oct 10, 2024
Malware in getsafe-interview
1 compromised version
- Oct 10, 2024
Malware in vue-assignment
1 compromised version
- Oct 10, 2024
Malware in hilla-components-dependencies
1 compromised version
- Oct 10, 2024
Malware in vention-quest
1 compromised version
- Oct 10, 2024
Malware in numeral-light
1 compromised version
- Oct 10, 2024
Malware in speech-to-speech-demo
1 compromised version
- Oct 10, 2024
Malware in com.lootlocker.lootlockersdk
1 compromised version
- Oct 10, 2024
Malware in discord-api-docs
1 compromised version
- Oct 10, 2024
Malware in briefer
1 compromised version
- Oct 10, 2024
Malware in ws-api-typescript-websocket-hooks
1 compromised version
- Oct 10, 2024
Malware in botframework-webchat-cldr-data-downloader
1 compromised version
- Oct 10, 2024
Malware in descriptiongenerator-typescript-runtime
1 compromised version
- Oct 10, 2024
Malware in quantum-visualization
1 compromised version
- Oct 10, 2024
Malware in ads-api-report-fetcher
1 compromised version
- Oct 10, 2024
Malware in ws-api-typescript-infra
1 compromised version
- Oct 10, 2024
Malware in b2b-buyer-portal
1 compromised version
- Oct 10, 2024
Malicious code in multiply-proxy-actions-contracts (npm)
- Oct 10, 2024
Malicious code in blockpi (npm)
- Oct 10, 2024
Malware in defillama-apy-server
1 compromised version
- Oct 10, 2024
Malware in multiply-proxy-actions-contracts
1 compromised version
- Oct 10, 2024
Malware in blockpi
1 compromised version
- Oct 10, 2024
Malicious code in ens-metadata-service (npm)
- Oct 10, 2024
Malware in ens-metadata-service
1 compromised version
- Oct 10, 2024
Malicious code in cli-command-with-alias (npm)
- Oct 10, 2024
Malware in cli-command-with-alias
1 compromised version
- Oct 10, 2024
Malicious code in node-red-contrib-lowwercase (npm)
2 compromised versions
- Oct 10, 2024
Malware in node-red-contrib-lowwercase
1 compromised version
Page 6541 of 7,307