Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,274 total · sorted newest first- Sep 27, 2024
Malware in autocomplete-monorepo
1 compromised version
- Sep 27, 2024
Malicious code in djangopeople (npm)
- Sep 27, 2024
Malware in djangopeople
1 compromised version
- Sep 27, 2024
Malware in spiffetest.io
1 compromised version
- Sep 27, 2024
Malware in spiffe.io
1 compromised version
- Sep 27, 2024
Malware in mobilistensampleapp
1 compromised version
- Sep 27, 2024
Malware in djangosnippets
1 compromised version
- Sep 27, 2024
Malicious code in routerpairs (npm)
- Sep 27, 2024
Malicious code in poolpairs (npm)
- Sep 27, 2024
Malware in routerpairs
1 compromised version
- Sep 27, 2024
Malware in poolpairs
1 compromised version
- Sep 26, 2024
Malicious code in fdx-mock-app (npm)
3 compromised versions
- Sep 26, 2024
Malicious code in setup-specmatic (npm)
1 compromised version
- Sep 26, 2024
Malicious code in spiffetest.io (npm)
1 compromised version
- Sep 26, 2024
Malicious code in spiffe.io (npm)
2 compromised versions
- Sep 26, 2024
Malicious code in djangosnippets (npm)
1 compromised version
- Sep 26, 2024
Malicious code in csm-installation-wizard (npm)
3 compromised versions
- Sep 26, 2024
Malicious code in defillama-apy-server (npm)
1 compromised version
- Sep 26, 2024
Malicious code in atomic-swap (npm)
3 compromised versions
- Sep 26, 2024
Malicious code in mobilistensampleapp (npm)
1 compromised version
- Sep 26, 2024
Malicious code in sunrequests (PyPI)
1 compromised version
- Sep 26, 2024
Malicious code in collaborator-trigger05 (npm)
2 compromised versions
- Sep 26, 2024
Malicious code in dx-shared-schema (npm)
3 compromised versions
- Sep 26, 2024
Malware in dx-shared-schema
1 compromised version
- Sep 25, 2024
Malicious code in @dp-bpsc-tiktok/ogc-analytics (npm)
1 compromised version
- Sep 25, 2024
Malicious code in b2b-buyer-portal (npm)
2 compromised versions
- Sep 25, 2024
Malicious code in faest (PyPI)
1 compromised version
- Sep 25, 2024
Malicious code in case-result-reporter (npm)
1 compromised version
- Sep 25, 2024
Malicious code in common-icons (npm)
3 compromised versions
- Sep 25, 2024
Malicious code in visa-ui-angular (npm)
1 compromised version
- Sep 25, 2024
Malicious code in k0m3g4-test (npm)
2 compromised versions
- Sep 25, 2024
Malicious code in uikit-app-promotions-sample (npm)
- Sep 25, 2024
Malicious code in sendbird-uikit-gpt (npm)
- Sep 25, 2024
Malicious code in quickstart-calls-chat-integration (npm)
- Sep 25, 2024
Malicious code in internet-header (npm)
- Sep 25, 2024
Malicious code in design-system-migrations (npm)
- Sep 25, 2024
Malicious code in design-system-intranet-header-workspace (npm)
- Sep 25, 2024
Malicious code in design-system-components-angular (npm)
- Sep 25, 2024
Malicious code in com.sendbird.chat (npm)
- Sep 25, 2024
Malicious code in cktool.target.nodejs (npm)
- Sep 25, 2024
Malware in uikit-app-promotions-sample
1 compromised version
- Sep 25, 2024
Malware in design-system-intranet-header-workspace
1 compromised version
- Sep 25, 2024
Malware in design-system-components-angular
1 compromised version
- Sep 25, 2024
Malware in internet-header
1 compromised version
- Sep 25, 2024
Malware in design-system-migrations
1 compromised version
- Sep 25, 2024
Malware in cktool.target.nodejs
1 compromised version
- Sep 25, 2024
Malware in com.sendbird.chat
1 compromised version
- Sep 25, 2024
Malware in quickstart-calls-chat-integration
1 compromised version
- Sep 25, 2024
Malware in sendbird-uikit-gpt
1 compromised version
- Sep 25, 2024
Malicious code in cktool.database (npm)
Page 6549 of 7,306