Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,620 total · sorted newest first- Jun 18, 2024
Malicious code in detailimg (npm)
- Jun 18, 2024
Malicious code in desainlgo (npm)
- Jun 18, 2024
Malware in logooo
1 compromised version
- Jun 18, 2024
Malware in desainlgo
1 compromised version
- Jun 18, 2024
Malware in logo-stylee
1 compromised version
- Jun 18, 2024
Malware in stylee-logo
1 compromised version
- Jun 18, 2024
Malware in mediaa
1 compromised version
- Jun 18, 2024
Malware in detailimg
1 compromised version
- Jun 18, 2024
Malware in imagezz
1 compromised version
- Jun 17, 2024
Malicious code in delta0231 (npm)
1 compromised version
- Jun 17, 2024
Malicious code in commando333333 (npm)
1 compromised version
- Jun 17, 2024
Malicious code in dc-test1-asdf (npm)
4 compromised versions
- Jun 17, 2024
Malicious code in importlib-metadate (PyPI)
2 compromised versions
- Jun 17, 2024
Malicious code in nt4padyp3 (PyPI)
2 compromised versions
- Jun 17, 2024
Malware in pwnkunwar
1 compromised version
- Jun 17, 2024
Malicious code in corraldev-activationsvc (npm)
- Jun 17, 2024
Malicious code in @corraldev/cli (npm)
- Jun 17, 2024
Malware in @corraldev/cli
1 compromised version
- Jun 17, 2024
Malware in braintree-rpc
1 compromised version
- Jun 17, 2024
Malware in corraldev-activationsvc
1 compromised version
- Jun 17, 2024
Malware in braintree-utilities
1 compromised version
- Jun 17, 2024
Malware in @yoimiiya/fetchs
1 compromised version
- Jun 17, 2024
Malware in colors-styles
1 compromised version
- Jun 17, 2024
Malicious code in airbnb-o2 (npm)
1 compromised version
- Jun 16, 2024
Malware in @cart-ui/core-i18n
1 compromised version
- Jun 15, 2024
Malicious code in employee-schedule (npm)
1 compromised version
- Jun 14, 2024
Malicious code in uxcamreactexample (npm)
1 compromised version
- Jun 14, 2024
Malicious code in @cart-ui/core-i18n (npm)
1 compromised version
- Jun 14, 2024
Malicious code in @yoimiiya/fetchs (npm)
4 compromised versions
- Jun 13, 2024
Malicious code in trip-component-platform-online-subscribe-checkbox (npm)
2 compromised versions
- Jun 13, 2024
Malicious code in colors-styles (npm)
1 compromised version
- Jun 13, 2024
Malicious code in elasticsearch-client-specification (npm)
1 compromised version
- Jun 13, 2024
Malicious code in djangosnippets.org (npm)
- Jun 13, 2024
Malware in djangosnippets.org
1 compromised version
- Jun 13, 2024
Malware in elasticsearch-client-specification
1 compromised version
- Jun 13, 2024
Malware in virtuoso-ui-common
1 compromised version
- Jun 13, 2024
Malicious code in legacyreact-aws-s3-typescript (npm)
6 compromised versions
- Jun 13, 2024
Malware in legacyreact-aws-s3-typescript
1 compromised version
- Jun 13, 2024
Malicious code in dependences (npm)
1 compromised version
- Jun 13, 2024
Malware in dependences
1 compromised version
- Jun 13, 2024
Malicious code in @yashorg/frontend-logger (npm)
1 compromised version
- Jun 13, 2024
Malware in @yashorg/frontend-logger
1 compromised version
- Jun 12, 2024
Malicious code in v2-core (npm)
- Jun 12, 2024
Malware in aws-check
1 compromised version
- Jun 12, 2024
Malware in v2-core
1 compromised version
- Jun 12, 2024
Malware in aws-public
1 compromised version
- Jun 12, 2024
Malicious code in ozonid (npm)
- Jun 12, 2024
Malicious code in ozon-js (npm)
- Jun 12, 2024
Malicious code in exel-js (npm)
- Jun 12, 2024
Malicious code in core-webpack (npm)
Page 6726 of 7,293