Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,620 total · sorted newest first- Mar 8, 2024
Malicious code in pet-profile-micro-interaction (npm)
1 compromised version
- Mar 8, 2024
Malware in pet-profile-micro-interaction
1 compromised version
- Mar 8, 2024
Malicious code in booto3 (PyPI)
1 compromised version
- Mar 8, 2024
Malicious code in @spectrocoin/sc-currencies (npm)
2 compromised versions
- Mar 7, 2024
Malicious code in jaas-jwt (npm)
1 compromised version
- Mar 7, 2024
Malicious code in pcln-event-dispatcher (npm)
4 compromised versions
- Mar 6, 2024
Malicious code in c3-pricecaster (npm)
2 compromised versions
- Mar 6, 2024
Malicious code in add-sugar (npm)
4 compromised versions
- Mar 5, 2024
Malicious code in win32crypted (npm)
- Mar 5, 2024
Malware in win32crypted
1 compromised version
- Mar 3, 2024
Malicious code in testien1 (npm)
1 compromised version
- Mar 3, 2024
Malicious code in relativity-web-component (npm)
3 compromised versions
- Mar 2, 2024
Malicious code in build-benchmarks (npm)
1 compromised version
- Mar 2, 2024
Malicious code in pyalicet (PyPI)
2 compromised versions
- Mar 1, 2024
Malicious code in sdge-it-tdg-dynamicloadprofiles (npm)
2 compromised versions
- Mar 1, 2024
Malicious code in @apics/apps-ppp-web (npm)
5 compromised versions
- Feb 29, 2024
Malicious code in tokenspair (npm)
- Feb 29, 2024
Malicious code in tokenpairs (npm)
- Feb 29, 2024
Malware in tokenspair
1 compromised version
- Feb 29, 2024
Malware in tokenpairs
1 compromised version
- Feb 29, 2024
Malicious code in tokenpair (npm)
- Feb 29, 2024
Malware in tokenpair
1 compromised version
- Feb 28, 2024
Malicious code in bubble-dev (npm)
2 compromised versions
- Feb 28, 2024
Malicious code in ux1-ui-kit-theme (npm)
1 compromised version
- Feb 27, 2024
Malicious code in is24-desktop (npm)
4 compromised versions
- Feb 27, 2024
Malicious code in emilkylandertestnpmpackge (npm)
- Feb 27, 2024
Malware in emilkylandertestnpmpackge
1 compromised version
- Feb 27, 2024
Malicious code in frd-rsa-js (npm)
- Feb 27, 2024
Malware in frd-rsa-js
1 compromised version
- Feb 27, 2024
Malware in usaa-wdio-utils
1 compromised version
- Feb 27, 2024
Malicious code in ent-profile-logger (npm)
- Feb 27, 2024
Malware in ent-profile-logger
1 compromised version
- Feb 26, 2024
Malicious code in nodejs-socket (npm)
- Feb 26, 2024
Malware in nodejs-socket
1 compromised version
- Feb 24, 2024
Malicious code in virtuoso-ui-common (npm)
5 compromised versions
- Feb 23, 2024
Malicious code in djanggo (PyPI)
2 compromised versions
- Feb 22, 2024
Malicious code in fekirinetest3 (npm)
1 compromised version
- Feb 22, 2024
Malicious code in xo-page-components (npm)
2 compromised versions
- Feb 21, 2024
Malicious code in disc-web-sender (npm)
- Feb 21, 2024
Malware in disc-web-sender
1 compromised version
- Feb 21, 2024
Malicious code in uikit-dark-mode (npm)
1 compromised version
- Feb 21, 2024
Malicious code in testconfusiontestt (npm)
- Feb 21, 2024
Malicious code in scytheetest (npm)
- Feb 21, 2024
Malicious code in node-red-contrib-object-to-array (npm)
- Feb 21, 2024
Malware in node-red-contrib-object-to-array
1 compromised version
- Feb 21, 2024
Malware in scytheetest
1 compromised version
- Feb 21, 2024
Malware in testconfusiontestt
1 compromised version
- Feb 21, 2024
Malicious code in ember-power-calendar-dayjs (npm)
- Feb 21, 2024
Malware in ember-power-calendar-dayjs
1 compromised version
- Feb 20, 2024
Malicious code in djs-colors-v14 (npm)
2 compromised versions
Page 6746 of 7,293