Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,331 total · sorted newest first- Jul 25, 2024
Malicious code in webvisitor (npm)
- Jul 25, 2024
Malicious code in webjsflood (npm)
- Jul 25, 2024
Malicious code in overflood (npm)
- Jul 25, 2024
Malicious code in httpsflood (npm)
- Jul 25, 2024
Malicious code in floodtcpudp (npm)
- Jul 25, 2024
Malware in httpsflood
1 compromised version
- Jul 25, 2024
Malware in webvisitor
1 compromised version
- Jul 25, 2024
Malware in floodtcpudp
1 compromised version
- Jul 25, 2024
Malware in overflood
1 compromised version
- Jul 25, 2024
Malware in webjsflood
1 compromised version
- Jul 24, 2024
Malicious code in evil-package (PyPI)
3 compromised versions
- Jul 24, 2024
Malicious code in pybanners (PyPI)
4 compromised versions
- Jul 24, 2024
Malicious code in health-check-nodejs (npm)
1 compromised version
- Jul 24, 2024
Malicious code in @vertiv-co/ui-library-nextgen (npm)
1 compromised version
- Jul 24, 2024
Malicious code in @vertiv-co/viewer-service-library (npm)
1 compromised version
- Jul 24, 2024
Malicious code in smart-input-textarea (npm)
- Jul 24, 2024
Malicious code in smart-input-checkbox (npm)
- Jul 24, 2024
Malicious code in lol1234 (npm)
- Jul 24, 2024
Malware in smart-input-checkbox
1 compromised version
- Jul 24, 2024
Malware in smart-input-textarea
1 compromised version
- Jul 24, 2024
Malware in lol1234
1 compromised version
- Jul 23, 2024
Malicious code in infowrap-filepicker (npm)
1 compromised version
- Jul 23, 2024
Malicious code in appds-nodejs-utils (npm)
1 compromised version
- Jul 23, 2024
Malware in roblox-ts-core
1 compromised version
- Jul 22, 2024
Malicious code in popeye-xyz (PyPI)
1 compromised version
- Jul 22, 2024
Malicious code in popeye-pip-v3 (PyPI)
1 compromised version
- Jul 22, 2024
Malicious code in next-react-notify (npm)
1 compromised version
- Jul 22, 2024
Malicious code in tyibyc (npm)
2 compromised versions
- Jul 22, 2024
Malicious code in roblox-ts-core (npm)
2 compromised versions
- Jul 22, 2024
Malicious code in jqtools-toolbox-expose (npm)
2 compromised versions
- Jul 22, 2024
Malicious code in chromestatus-openapi (npm)
3 compromised versions
- Jul 22, 2024
Malicious code in sap-accesslevel (npm)
1 compromised version
- Jul 22, 2024
Malicious code in sap-ac (npm)
4 compromised versions
- Jul 22, 2024
Malicious code in sap-abstract (npm)
176 compromised versions
- Jul 22, 2024
Malicious code in sap-about (npm)
3 compromised versions
- Jul 22, 2024
Malicious code in sap-abort (npm)
2 compromised versions
- Jul 22, 2024
Malware in sap-abstract
1 compromised version
- Jul 22, 2024
Malware in sap-abort
1 compromised version
- Jul 22, 2024
Malware in sap-about
1 compromised version
- Jul 22, 2024
Malware in sap-access
1 compromised version
- Jul 22, 2024
Malware in sap-accesslevel
1 compromised version
- Jul 22, 2024
Malware in sap-ac
1 compromised version
- Jul 22, 2024
Malicious code in sap-accept (npm)
5 compromised versions
- Jul 22, 2024
Malware in sap-accept
1 compromised version
- Jul 22, 2024
Malware in toolbox-controller
1 compromised version
- Jul 22, 2024
Malware in zonduutest
1 compromised version
- Jul 21, 2024
Malicious code in google-map-markerclusterer (npm)
1 compromised version
- Jul 21, 2024
Malicious code in angular-material-panel (npm)
1 compromised version
- Jul 21, 2024
Malicious code in fintual-emojifier (npm)
1 compromised version
- Jul 21, 2024
Malicious code in hexteamibm (PyPI)
1 compromised version
Page 6603 of 7,307