Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,336 total · sorted newest first- Oct 9, 2024
Malicious code in uploadcare-ckeditor (npm)
1 compromised version
- Oct 9, 2024
Malicious code in sachinkrhackeronetestpackage (npm)
- Oct 9, 2024
Malicious code in replaceable-media-recorder (npm)
- Oct 9, 2024
Malicious code in openai-examples (npm)
1 compromised version
- Oct 9, 2024
Malicious code in d11-conventional-jira-changelog (npm)
1 compromised version
- Oct 9, 2024
Malicious code in branch-design-system (npm)
1 compromised version
- Oct 9, 2024
Malicious code in braintree_express_example (npm)
- Oct 9, 2024
Malicious code in braintree.github.io (npm)
- Oct 9, 2024
Malware in hulululu
1 compromised version
- Oct 9, 2024
Malware in d11-conventional-jira-changelog
1 compromised version
- Oct 9, 2024
Malware in sachinkrhackeronetestpackage
1 compromised version
- Oct 9, 2024
Malware in braintree_express_example
1 compromised version
- Oct 9, 2024
Malware in replaceable-media-recorder
1 compromised version
- Oct 9, 2024
Malware in branch-design-system
1 compromised version
- Oct 9, 2024
Malware in openai-examples
1 compromised version
- Oct 9, 2024
Malware in braintree.github.io
1 compromised version
- Oct 9, 2024
Malware in uploadcare-ckeditor
1 compromised version
- Oct 9, 2024
Malicious code in videojs-sneakpeek (npm)
- Oct 9, 2024
Malicious code in uchiwa (npm)
1 compromised version
- Oct 9, 2024
Malicious code in svelte-hms-world (npm)
1 compromised version
- Oct 9, 2024
Malicious code in sp-api-app-cdk (npm)
- Oct 9, 2024
Malicious code in snyk.io (npm)
- Oct 9, 2024
Malicious code in sdk-integration-tests (npm)
- Oct 9, 2024
Malicious code in sae-viewer (npm)
- Oct 9, 2024
Malicious code in redis-examples (npm)
- Oct 9, 2024
Malicious code in openai-bun-test (npm)
- Oct 9, 2024
Malicious code in nanoslackts-env-test (npm)
- Oct 9, 2024
Malicious code in makebetteremail (npm)
2 compromised versions
- Oct 9, 2024
Malicious code in language-rego (npm)
1 compromised version
- Oct 9, 2024
Malicious code in kubeman (npm)
- Oct 9, 2024
Malicious code in juno-composer (npm)
- Oct 9, 2024
Malicious code in google.fhir.r4.google (npm)
- Oct 9, 2024
Malicious code in buy-sell-opensea-sdk-demo (npm)
- Oct 9, 2024
Malicious code in branch-extension (npm)
- Oct 9, 2024
Malicious code in backend-engineering-test (npm)
- Oct 9, 2024
Malicious code in asp.app (npm)
- Oct 9, 2024
Malicious code in annotation-app (npm)
- Oct 9, 2024
Malicious code in agoda-design-toolkit-2 (npm)
4 compromised versions
- Oct 9, 2024
Malware in sae-viewer
1 compromised version
- Oct 9, 2024
Malware in kubeman
1 compromised version
- Oct 9, 2024
Malware in redis-examples
1 compromised version
- Oct 9, 2024
Malware in sdk-integration-tests
1 compromised version
- Oct 9, 2024
Malware in agoda-design-toolkit-2
1 compromised version
- Oct 9, 2024
Malware in makebetteremail
1 compromised version
- Oct 9, 2024
Malware in nanoslackts-env-test
1 compromised version
- Oct 9, 2024
Malware in backend-engineering-test
1 compromised version
- Oct 9, 2024
Malware in asp.app
1 compromised version
- Oct 9, 2024
Malware in buy-sell-opensea-sdk-demo
1 compromised version
- Oct 9, 2024
Malware in annotation-app
1 compromised version
- Oct 9, 2024
Malware in svelte-hms-world
1 compromised version
Page 6545 of 7,307