Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,620 total · sorted newest first- Jun 11, 2024
Malware in mmsdk-apml-htmlrenderer
1 compromised version
- Jun 11, 2024
Malicious code in ct-helpers (npm)
4 compromised versions
- Jun 11, 2024
Malicious code in coe.com (npm)
- Jun 11, 2024
Malicious code in code.jquery.ajax (npm)
- Jun 11, 2024
Malicious code in code.cloudflare.com (npm)
- Jun 11, 2024
Malicious code in code.cloudflare.ajax (npm)
- Jun 11, 2024
Malware in code.jquery.ajax
1 compromised version
- Jun 11, 2024
Malware in code.cloudflare.ajax
1 compromised version
- Jun 11, 2024
Malware in code.cloudflare.com
1 compromised version
- Jun 11, 2024
Malware in coe.com
1 compromised version
- Jun 11, 2024
Malicious code in aws-public (npm)
1 compromised version
- Jun 11, 2024
Malicious code in nppe_ttt_datalayer (npm)
1 compromised version
- Jun 11, 2024
Malware in purina-parent-theme
1 compromised version
- Jun 11, 2024
Malware in nppe_ttt_datalayer
1 compromised version
- Jun 11, 2024
Malicious code in workerd-root (npm)
1 compromised version
- Jun 11, 2024
Malware in workerd-root
1 compromised version
- Jun 11, 2024
Malware in hybrid-custody
1 compromised version
- Jun 11, 2024
Malware in glamorous-codemods
1 compromised version
- Jun 11, 2024
Malware in vue-webviews
1 compromised version
- Jun 11, 2024
Malware in vue2-webviews
1 compromised version
- Jun 10, 2024
Malicious code in randombullshitgo-js (npm)
1 compromised version
- Jun 10, 2024
Malicious code in aws-check (npm)
1 compromised version
- Jun 10, 2024
Malicious code in aws-logs (npm)
1 compromised version
- Jun 10, 2024
Malicious code in rb-payment-wallet (npm)
1 compromised version
- Jun 9, 2024
Malicious code in test-pkg-blabla (npm)
14 compromised versions
- Jun 9, 2024
Malicious code in pwnkunwar (npm)
1 compromised version
- Jun 9, 2024
Malicious code in scm-design-system-cra (npm)
1 compromised version
- Jun 9, 2024
Malicious code in braintree-rpc (npm)
2 compromised versions
- Jun 9, 2024
Malicious code in braintree-utilities (npm)
2 compromised versions
- Jun 8, 2024
Malicious code in cosma-ui-icons (npm)
1 compromised version
- Jun 8, 2024
Malicious code in glamorous-codemods (npm)
1 compromised version
- Jun 8, 2024
Malicious code in rey-vue-smarttable (npm)
2 compromised versions
- Jun 8, 2024
Malicious code in rey-vue-common (npm)
3 compromised versions
- Jun 7, 2024
Malicious code in hybrid-custody (npm)
1 compromised version
- Jun 7, 2024
Malicious code in @ing-caf/cdn-proxy-plugin (npm)
1 compromised version
- Jun 7, 2024
Malicious code in purina-parent-theme (npm)
1 compromised version
- Jun 7, 2024
Malicious code in integration-web-core--socle (npm)
1 compromised version
- Jun 7, 2024
Malicious code in vue2-webviews (npm)
1 compromised version
- Jun 7, 2024
Malicious code in vue-webviews (npm)
1 compromised version
- Jun 6, 2024
Malicious code in ing-feat-uilib-de (npm)
1 compromised version
- Jun 6, 2024
Malicious code in ing-shared-navigation-de (npm)
1 compromised version
- Jun 6, 2024
Malicious code in testpentesting123xyz (npm)
1 compromised version
- Jun 6, 2024
Malicious code in node-pre-gyp-test-app2 (npm)
1 compromised version
- Jun 6, 2024
Malicious code in pentesters987abc (npm)
1 compromised version
- Jun 6, 2024
Malicious code in mapbox-demo-gl-style-spec (npm)
1 compromised version
- Jun 6, 2024
Malicious code in tensorfioi (PyPI)
1 compromised version
- Jun 6, 2024
Malicious code in requestn (PyPI)
1 compromised version
- Jun 6, 2024
Malicious code in Nasrtox (PyPI)
1 compromised version
- Jun 6, 2024
Malicious code in Costrar (PyPI)
1 compromised version
- Jun 5, 2024
Malicious code in com.unity.cloud.gltfast (npm)
Page 6728 of 7,293