Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,620 total · sorted newest first- Mar 24, 2024
Malicious code in hessskinchecker (npm)
- Mar 24, 2024
Malicious code in francoadvisor (npm)
- Mar 24, 2024
Malware in francoadvisor
1 compromised version
- Mar 24, 2024
Malware in trujillocheck
1 compromised version
- Mar 24, 2024
Malware in hessskinchecker
1 compromised version
- Mar 24, 2024
Malicious code in win-regi (npm)
- Mar 24, 2024
Malicious code in gkldjdkljgdklfgj (npm)
- Mar 24, 2024
Malicious code in btcbip-39 (npm)
- Mar 24, 2024
Malware in btcbip-39
1 compromised version
- Mar 24, 2024
Malware in win-regi
1 compromised version
- Mar 24, 2024
Malware in gkldjdkljgdklfgj
1 compromised version
- Mar 24, 2024
Malicious code in odyssey-lint-staged (npm)
1 compromised version
- Mar 24, 2024
Malicious code in google-requests (PyPI)
1 compromised version
- Mar 24, 2024
Malicious code in familylink (npm)
2 compromised versions
- Mar 23, 2024
Malicious code in lyft-service (PyPI)
1 compromised version
- Mar 21, 2024
Malicious code in boukiapi (npm)
- Mar 21, 2024
Malware in boukiapi
1 compromised version
- Mar 21, 2024
Malicious code in tomori-discord (npm)
- Mar 21, 2024
Malicious code in discordinfos (npm)
- Mar 21, 2024
Malware in discordinfos
1 compromised version
- Mar 21, 2024
Malware in tomori-discord
1 compromised version
- Mar 21, 2024
Malware in caas-static
1 compromised version
- Mar 21, 2024
Malicious code in u-workflow.module.common.brand-safety (npm)
1 compromised version
- Mar 21, 2024
Malicious code in u-workflow.module.common.features (npm)
1 compromised version
- Mar 21, 2024
Malicious code in region-selector-content (npm)
2 compromised versions
- Mar 19, 2024
Malicious code in caas-static (npm)
3 compromised versions
- Mar 19, 2024
Malicious code in u-workflow.module.common.webapp (npm)
1 compromised version
- Mar 19, 2024
Malicious code in pulsate (npm)
1 compromised version
- Mar 19, 2024
Malicious code in super-social-sdk (npm)
- Mar 19, 2024
Malware in super-social-sdk
1 compromised version
- Mar 19, 2024
Malware in formvalidationtestauth
1 compromised version
- Mar 19, 2024
Malware in r101-css
1 compromised version
- Mar 19, 2024
Malicious code in @testorgggg/pkg3 (npm)
- Mar 19, 2024
Malware in @testorgggg/pkg3
1 compromised version
- Mar 19, 2024
Malicious code in raydium-connect (npm)
- Mar 19, 2024
Malware in raydium-connect
1 compromised version
- Mar 19, 2024
Malicious code in espn-react-oneid (npm)
1 compromised version
- Mar 19, 2024
Malicious code in abcotv-story-parser (npm)
1 compromised version
- Mar 18, 2024
Malicious code in polaris-resource-list-examples (npm)
- Mar 18, 2024
Malicious code in functions-workshop (npm)
- Mar 18, 2024
Malicious code in flow-code-examples (npm)
- Mar 18, 2024
Malicious code in eng-intern-assessment-react-native (npm)
- Mar 18, 2024
Malicious code in custom-banner-react (npm)
- Mar 18, 2024
Malicious code in action-and-block (npm)
- Mar 18, 2024
Malware in functions-workshop
1 compromised version
- Mar 18, 2024
Malware in polaris-resource-list-examples
1 compromised version
- Mar 18, 2024
Malware in eng-intern-assessment-react-native
1 compromised version
- Mar 18, 2024
Malware in custom-banner-react
1 compromised version
- Mar 18, 2024
Malware in action-and-block
1 compromised version
- Mar 18, 2024
Malware in flow-code-examples
1 compromised version
Page 6743 of 7,293