Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,620 total · sorted newest first- Jun 25, 2024
Malicious code in invoices (npm)
1 compromised version
- Jun 25, 2024
Malicious code in inventory (npm)
1 compromised version
- Jun 25, 2024
Malicious code in integrations (npm)
1 compromised version
- Jun 25, 2024
Malicious code in direct-debit (npm)
1 compromised version
- Jun 25, 2024
Malicious code in dashboard (npm)
1 compromised version
- Jun 25, 2024
Malicious code in customers (npm)
1 compromised version
- Jun 25, 2024
Malicious code in cash-register (npm)
1 compromised version
- Jun 25, 2024
Malicious code in capital (npm)
1 compromised version
- Jun 25, 2024
Malicious code in bootstrapper (npm)
1 compromised version
- Jun 25, 2024
Malicious code in bank-settings (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @zettle-bo/apps (npm)
1 compromised version
- Jun 25, 2024
Malicious code in account-statement (npm)
1 compromised version
- Jun 25, 2024
Malicious code in account-settings (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @youse-seguradora/youse-frontend (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in fetchs (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @yieldstreet/ui-kit (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @y9d-adobe/analytics (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @y9c-login/chat-bot (npm)
1 compromised version
- Jun 25, 2024
Malicious code in tangram (npm)
9 compromised versions
- Jun 25, 2024
Malicious code in lumberjack (npm)
8 compromised versions
- Jun 25, 2024
Malicious code in edge (npm)
7 compromised versions
- Jun 25, 2024
Malicious code in @xbox-web/xbox-foundation (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @xbox-web/sdk-components (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @xbox-web/partner-onboarding (npm)
1 compromised version
- Jun 25, 2024
Malicious code in iceberg (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @w3ds/w3ds (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @vk-tech/d11n-preparer (npm)
4 compromised versions
- Jun 25, 2024
Malicious code in @vk-tech/d11n-portal (npm)
4 compromised versions
- Jun 25, 2024
Malicious code in @vk-tech/d11n-audit (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in @vipulsahu/qlik-sense (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @unifocus/react (npm)
1 compromised version
- Jun 25, 2024
Malicious code in react (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @twork-mf/core (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @twork-mf/common (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @the-platform-group/component-library (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @terraform-aws-github-runner/gh-agent-syncer (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @terraform-aws-github-runner/aws-powertools-util (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @tauh33dkhan/alloy-icons (npm)
1 compromised version
- Jun 25, 2024
Malicious code in add-two (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @tabby.ai/qaseio-playwright-reporter (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @store-sfdcbt-net/cicd_gulp-central-js-lib-v1 (npm)
9 compromised versions
- Jun 25, 2024
Malicious code in common-frontend-components (npm)
10 compromised versions
- Jun 25, 2024
Malicious code in ocore (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @sheinoutmobile/sheinoutmobile (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @shamim12_12/iniconfig (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @sbermarketing/mrm-ui (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @sber-sberx-prime/prime-ui-kit (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @satsuitesdk/daik0n (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @salvapp/ui-components (npm)
1 compromised version
- Jun 25, 2024
Malicious code in admin-panel (npm)
4 compromised versions
Page 6720 of 7,293