Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,336 total · sorted newest first- Oct 1, 2024
Malicious code in cloudflare-docs-starlight (npm)
2 compromised versions
- Oct 1, 2024
Malicious code in website-scanner (PyPI)
1 compromised version
- Oct 1, 2024
Malicious code in algoliasearch-v5 (npm)
1 compromised version
- Oct 1, 2024
Malicious code in @facetca/facet-mmleditor (npm)
2 compromised versions
- Oct 1, 2024
Malicious code in google-play-store (PyPI)
1 compromised version
- Oct 1, 2024
Malicious code in nf-cl-logger (npm)
1 compromised version
- Oct 1, 2024
Malicious code in axp-product-ducks (npm)
1 compromised version
- Oct 1, 2024
Malicious code in xto10x (npm)
1 compromised version
- Oct 1, 2024
Malware in xto10x
1 compromised version
- Oct 1, 2024
Malicious code in wagmi-toolkit (npm)
- Oct 1, 2024
Malware in wagmi-toolkit
1 compromised version
- Oct 1, 2024
Malware in labelv2
1 compromised version
- Oct 1, 2024
Malicious code in thirdweb-eats (npm)
- Oct 1, 2024
Malicious code in steampipe-reports (npm)
- Oct 1, 2024
Malicious code in nodedum (npm)
- Oct 1, 2024
Malicious code in document-sample (npm)
- Oct 1, 2024
Malware in document-sample
1 compromised version
- Oct 1, 2024
Malware in atomic-swap
1 compromised version
- Oct 1, 2024
Malware in nodedum
1 compromised version
- Oct 1, 2024
Malware in steampipe-reports
1 compromised version
- Oct 1, 2024
Malware in thirdweb-eats
1 compromised version
- Oct 1, 2024
Malicious code in express-eval (npm)
18 compromised versions
- Oct 1, 2024
Malicious code in express-dompurify (npm)
- Oct 1, 2024
Malicious code in bcryptutils (npm)
- Oct 1, 2024
Malware in express-eval
1 compromised version
- Oct 1, 2024
Malware in express-dompurify
1 compromised version
- Oct 1, 2024
Malware in bcryptutils
1 compromised version
- Sep 30, 2024
Malicious code in hedgedoc-api (npm)
3 compromised versions
- Sep 30, 2024
Malicious code in ens.domains-v2 (npm)
1 compromised version
- Sep 30, 2024
Malicious code in transferwise-iconfont (npm)
1 compromised version
- Sep 30, 2024
Malicious code in world-id-sign-in (npm)
1 compromised version
- Sep 30, 2024
Malicious code in arkose-vue2-example (npm)
1 compromised version
- Sep 30, 2024
Malicious code in evolve-base-assets (npm)
1 compromised version
- Sep 30, 2024
Malicious code in hakka (npm)
1 compromised version
- Sep 30, 2024
Malware in o-layout
1 compromised version
- Sep 30, 2024
Malware in o-forms
1 compromised version
- Sep 30, 2024
Malware in peb_portal
1 compromised version
- Sep 30, 2024
Malware in whatnot_seller_api_docs
1 compromised version
- Sep 30, 2024
Malware in pod-financier-app
1 compromised version
- Sep 30, 2024
Malware in inclusive-ai-dao-website
1 compromised version
- Sep 30, 2024
Malware in fdx-mock-app
1 compromised version
- Sep 30, 2024
Malware in meraki-react-router
1 compromised version
- Sep 30, 2024
Malware in csm-installation-wizard
1 compromised version
- Sep 30, 2024
Malicious code in djangopeopletest (npm)
1 compromised version
- Sep 30, 2024
Malicious code in visionmedia-debug (npm)
1 compromised version
- Sep 30, 2024
Malicious code in jquery-ui-smoothness (npm)
- Sep 30, 2024
Malware in jquery-ui-smoothness
1 compromised version
- Sep 30, 2024
Malware in visionmedia-debug
1 compromised version
- Sep 30, 2024
Malware in font-lato-2-subset
1 compromised version
- Sep 29, 2024
Malicious code in dx-hotels-ui (npm)
1 compromised version
Page 6548 of 7,307