Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,620 total · sorted newest first- May 3, 2024
Malware in viseshthemed
1 compromised version
- May 2, 2024
Malicious code in discord-color (npm)
3 compromised versions
- May 2, 2024
Malicious code in hw-transition-animation (npm)
1 compromised version
- May 2, 2024
Malicious code in epc-primer-ui-tags (npm)
1 compromised version
- May 2, 2024
Malicious code in epc-notification-setting-web (npm)
1 compromised version
- May 2, 2024
Malicious code in scundev-pkg (npm)
1 compromised version
- May 2, 2024
Malware in grylls
1 compromised version
- May 2, 2024
Malicious code in clistsy-node (npm)
- May 2, 2024
Malware in clistsy-node
1 compromised version
- May 2, 2024
Malware in npm-package-shirley
1 compromised version
- May 2, 2024
Malicious code in agencyportal-web (npm)
- May 2, 2024
Malware in agencyportal-web
1 compromised version
- May 1, 2024
Malicious code in viseshthemed (npm)
2 compromised versions
- May 1, 2024
Malicious code in grylls (npm)
1 compromised version
- May 1, 2024
Malicious code in not-exist-lykos-poc2 (npm)
1 compromised version
- May 1, 2024
Malicious code in actions-next-bundle-analyzer (npm)
2 compromised versions
- Apr 30, 2024
Malicious code in discord.js-hex (npm)
3 compromised versions
- Apr 30, 2024
Malicious code in npm-package-shirley (npm)
5 compromised versions
- Apr 30, 2024
Malicious code in vue2-amis-custom-widget-kk (npm)
3 compromised versions
- Apr 30, 2024
Malicious code in vue2-amis-custom-widget-k (npm)
5 compromised versions
- Apr 30, 2024
Malware in vue2-amis-custom-widget-kk
1 compromised version
- Apr 30, 2024
Malware in vue2-amis-custom-widget-k
1 compromised version
- Apr 30, 2024
Malicious code in not-exist-lykos-poc (npm)
1 compromised version
- Apr 29, 2024
Malicious code in discords-logs (npm)
1 compromised version
- Apr 29, 2024
Malicious code in minecraft-net-core-services (npm)
2 compromised versions
- Apr 29, 2024
Malicious code in discord.js-red (npm)
- Apr 29, 2024
Malware in discord.js-red
1 compromised version
- Apr 29, 2024
Malicious code in ethutility (npm)
- Apr 29, 2024
Malware in ethutility
1 compromised version
- Apr 29, 2024
Malicious code in ethers-transactions (npm)
9 compromised versions
- Apr 29, 2024
Malware in ethers-transactions
1 compromised version
- Apr 24, 2024
Malicious code in rollremainsweet (npm)
- Apr 24, 2024
Malicious code in relinquishsecurecontinuous (npm)
- Apr 24, 2024
Malicious code in pleadappointmentat (npm)
- Apr 24, 2024
Malicious code in pardonbeefconfession (npm)
- Apr 24, 2024
Malicious code in driftdegreerubbish (npm)
- Apr 24, 2024
Malware in pardonbeefconfession
1 compromised version
- Apr 24, 2024
Malware in driftdegreerubbish
1 compromised version
- Apr 24, 2024
Malware in relinquishsecurecontinuous
1 compromised version
- Apr 24, 2024
Malware in rollremainsweet
1 compromised version
- Apr 24, 2024
Malware in pleadappointmentat
1 compromised version
- Apr 23, 2024
Malware in @ebay/ui-core-react
1 compromised version
- Apr 23, 2024
Malicious code in dev-ansi-terminal (npm)
- Apr 23, 2024
Malware in dev-ansi-terminal
1 compromised version
- Apr 23, 2024
Malicious code in colors-main (npm)
2 compromised versions
- Apr 23, 2024
Malware in colors-main
1 compromised version
- Apr 22, 2024
Malicious code in @symplr-ux/alloy-icons (npm)
- Apr 22, 2024
Malware in @symplr-ux/alloy-icons
1 compromised version
- Apr 22, 2024
Malicious code in teleport-app-example-node (npm)
1 compromised version
- Apr 22, 2024
Malicious code in swift-docc-rendeeeeeer (npm)
Page 6737 of 7,293