Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,620 total · sorted newest first- Jun 25, 2024
Malicious code in @hkbn/es-header-footer (npm)
4 compromised versions
- Jun 25, 2024
Malicious code in @harrysforge-ui/text (npm)
4 compromised versions
- Jun 25, 2024
Malicious code in @harrysforge-ui/badge (npm)
4 compromised versions
- Jun 25, 2024
Malicious code in pwn (npm)
16 compromised versions
- Jun 25, 2024
Malicious code in @golden-stack/babel-web (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @gds-web-ui/sodalite (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @gds-web-ui/core (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @fnt-cmd/template-engine (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @fnt-cmd/core (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in fixedwidthtable (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in @fdfe/zebra-sequelize-client (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @fdfe/mp-cashier (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @fdfe/eslint-rule-svg-rrggbbaa-check (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @fdfe/eslint-plugin-ins-common (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @fdfe/era-proxy (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @fdfe/era-cloud-uploader (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @fdfe/era-cellar (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @fdfe/era-build-runtime (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @fdfe/era-build (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @fdfe/ecf-http-adapter (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @expue/webpack (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @expue/vue3-renderer (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @expue/vue3-helper (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @expue/vue-renderer (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @expue/types (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @expue/shared (npm)
1 compromised version
- Jun 25, 2024
Malicious code in shared (npm)
8 compromised versions
- Jun 25, 2024
Malicious code in @expue/plugin-express (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @expue/core (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @expue/config (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @expue/cli (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @expue/builder (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @esportal/ui-kit (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @epgu/ui (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @epgu/epgu-constructor-types (npm)
3 compromised versions
- Jun 25, 2024
Malicious code in @epgu/epgu-constructor (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @elastic-internal/dojox (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @egds/search-experience (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @egds/lodging (npm)
4 compromised versions
- Jun 25, 2024
Malicious code in @dtx-company/flowcode-generator-types (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @doccledev/pattern-library (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @diligentcorp/atlas-ng (npm)
1 compromised version
- Jun 25, 2024
Malicious code in atlas-ng (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @corproot/sdx (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @corp-shared/adobe (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @corp-njord/core (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @colabsoftware/okami (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @colabsoftware/eslint-plugin (npm)
1 compromised version
- Jun 25, 2024
Malicious code in @clearing/models (npm)
2 compromised versions
- Jun 25, 2024
Malicious code in @chysev/exreact (npm)
1 compromised version
Page 6723 of 7,293