Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,336 total · sorted newest first- Oct 9, 2024
Malware in videojs-sneakpeek
1 compromised version
- Oct 9, 2024
Malware in juno-composer
1 compromised version
- Oct 9, 2024
Malware in language-rego
1 compromised version
- Oct 9, 2024
Malware in sp-api-app-cdk
1 compromised version
- Oct 9, 2024
Malware in google.fhir.r4.google
1 compromised version
- Oct 9, 2024
Malware in uchiwa
1 compromised version
- Oct 9, 2024
Malware in snyk.io
1 compromised version
- Oct 9, 2024
Malware in branch-extension
1 compromised version
- Oct 9, 2024
Malware in openai-bun-test
1 compromised version
- Oct 8, 2024
Malicious code in navb-pub (npm)
- Oct 8, 2024
Malware in navb-pub
1 compromised version
- Oct 8, 2024
Malicious code in sd-template-main (npm)
5 compromised versions
- Oct 8, 2024
Malicious code in msdhsfhjfj-cli (npm)
1 compromised version
- Oct 8, 2024
Malicious code in fake-usreagant (PyPI)
1 compromised version
- Oct 8, 2024
Malicious code in @fdp-tools/helm (npm)
1 compromised version
- Oct 8, 2024
Malicious code in @fdp-tools/eslint-formatter (npm)
1 compromised version
- Oct 8, 2024
Malicious code in @fdp-tools/observability (npm)
1 compromised version
- Oct 8, 2024
Malicious code in @fdp-tools/artifactory (npm)
1 compromised version
- Oct 8, 2024
Malicious code in @fdp-tools/bitbucket (npm)
1 compromised version
- Oct 8, 2024
Malicious code in @fdp-tools/snap (npm)
1 compromised version
- Oct 7, 2024
Malicious code in useregent-generator (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in user-random-agent-user (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in user-rand-agnt-user (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in user-gen-agent-random (PyPI)
3 compromised versions
- Oct 7, 2024
Malicious code in ua-agent-generator (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in sol-regex-gener (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in gen-user-random-agent (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in fake-usreagent (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in crypto-regex-gener (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in crypto-regex-checker (PyPI)
8 compromised versions
- Oct 7, 2024
Malicious code in crypto-format-checking (PyPI)
2 compromised versions
- Oct 7, 2024
Malicious code in agent-user-generate (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in ws-api-typescript-websocket-hooks (npm)
1 compromised version
- Oct 7, 2024
Malicious code in ws-api-typescript-infra (npm)
1 compromised version
- Oct 7, 2024
Malicious code in quantum-visualization (npm)
1 compromised version
- Oct 7, 2024
Malicious code in descriptiongenerator-typescript-runtime (npm)
1 compromised version
- Oct 7, 2024
Malicious code in botframework-webchat-cldr-data-downloader (npm)
1 compromised version
- Oct 7, 2024
Malicious code in ads-api-report-fetcher (npm)
1 compromised version
- Oct 7, 2024
Malicious code in ptsecurity (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in posi (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in maxpatrol (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in innostage-group (PyPI)
2 compromised versions
- Oct 7, 2024
Malicious code in innostage (PyPI)
6 compromised versions
- Oct 7, 2024
Malicious code in cyberart (PyPI)
1 compromised version
- Oct 7, 2024
Malicious code in protobufj-cli (npm)
1 compromised version
- Oct 7, 2024
Malicious code in monorepo-releaser (npm)
1 compromised version
- Oct 6, 2024
Malicious code in instaread (PyPI)
4 compromised versions
- Oct 5, 2024
Malicious code in o-typescript (npm)
1 compromised version
- Oct 5, 2024
Malicious code in no-typescript (npm)
1 compromised version
- Oct 5, 2024
Malicious code in m-typescript (npm)
4 compromised versions
Page 6546 of 7,307