Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
330,055 total · sorted newest first- May 31, 2022
Malware in sb1-adobe-analytics
1 compromised version
- May 31, 2022
Malicious code in @tr-digital/react-rehydrate (npm)
- May 31, 2022
Malware in @tr-digital/react-rehydrate
1 compromised version
- May 31, 2022
Malicious code in react-video-live-demo (npm)
- May 31, 2022
Malicious code in flipper-frontend-core (npm)
- May 31, 2022
Malicious code in coolqueue.io (npm)
- May 31, 2022
Malware in flipper-frontend-core
1 compromised version
- May 31, 2022
Malware in coolqueue.io
1 compromised version
- May 31, 2022
Malware in react-video-live-demo
1 compromised version
- May 31, 2022
Malicious code in amber-blocks (npm)
- May 31, 2022
Malicious code in volgactf (npm)
- May 31, 2022
Malware in amber-blocks
1 compromised version
- May 31, 2022
Malware in volgactf
1 compromised version
- May 31, 2022
Malicious code in @logistics-frontend/types (npm)
- May 31, 2022
Malicious code in @logistics-frontend/polyfills (npm)
- May 31, 2022
Malicious code in @logistics-frontend/ndd (npm)
- May 31, 2022
Malicious code in @logistics-frontend/modules (npm)
- May 31, 2022
Malicious code in @logistics-frontend/hooks (npm)
- May 31, 2022
Malicious code in @logistics-frontend/core (npm)
- May 31, 2022
Malware in @logistics-frontend/hooks
1 compromised version
- May 31, 2022
Malware in @logistics-frontend/ndd
1 compromised version
- May 31, 2022
Malware in @logistics-frontend/polyfills
1 compromised version
- May 31, 2022
Malware in @logistics-frontend/modules
1 compromised version
- May 31, 2022
Malware in @logistics-frontend/core
1 compromised version
- May 31, 2022
Malware in @logistics-frontend/types
1 compromised version
- May 31, 2022
Malicious code in @logistics-frontend/utils (npm)
- May 31, 2022
Malicious code in @logistics-frontend/ui-old (npm)
- May 31, 2022
Malicious code in @logistics-frontend/client-core (npm)
- May 31, 2022
Malicious code in @logistics-frontend/blocks (npm)
- May 31, 2022
Malware in @logistics-frontend/ui-old
1 compromised version
- May 31, 2022
Malware in @logistics-frontend/utils
1 compromised version
- May 31, 2022
Malware in @logistics-frontend/client-core
1 compromised version
- May 31, 2022
Malware in @logistics-frontend/blocks
1 compromised version
- May 31, 2022
Malicious code in dragox-utilities (npm)
- May 31, 2022
Malware in dragox-utilities
1 compromised version
- May 31, 2022
Malicious code in colors_express (npm)
- May 31, 2022
Malware in colors_express
1 compromised version
- May 31, 2022
Malicious code in rrequests (PyPI)
- May 31, 2022
Malicious code in reuests (PyPI)
- May 31, 2022
Malicious code in requuests (PyPI)
- May 31, 2022
Malicious code in requestts (PyPI)
- May 31, 2022
Malicious code in requessts (PyPI)
- May 31, 2022
Malicious code in requess (PyPI)
- May 31, 2022
Malicious code in requeests (PyPI)
- May 31, 2022
Malicious code in reqquests (PyPI)
- May 31, 2022
Malicious code in reequests (PyPI)
- May 31, 2022
Malicious code in equests (PyPI)
- May 23, 2022
Malicious code in @kibt/weblogger (npm)
- May 23, 2022
Malicious code in @kibt/operation-track (npm)
- May 23, 2022
Malware in @kibt/weblogger
1 compromised version
Page 6597 of 6,602