Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,620 total · sorted newest first- Feb 20, 2024
Malware in djs-colors-v14
1 compromised version
- Feb 20, 2024
Malicious code in eslint-plugin-unicorn-ts-2 (npm)
1 compromised version
- Feb 20, 2024
Malicious code in confusiontestt (npm)
1 compromised version
- Feb 20, 2024
Malicious code in ent-profile-api-client (npm)
1 compromised version
- Feb 20, 2024
Malicious code in usaa-wdio-utils (npm)
1 compromised version
- Feb 20, 2024
Malware in analysis-tool-app
1 compromised version
- Feb 20, 2024
Malware in analysis-shared-utils
1 compromised version
- Feb 20, 2024
Malware in lol-pizda
1 compromised version
- Feb 20, 2024
Malware in analysis-components
1 compromised version
- Feb 20, 2024
Malware in analysis-studio-components
1 compromised version
- Feb 19, 2024
Malicious code in uber-rv-web-common (npm)
- Feb 19, 2024
Malicious code in new-dependency-test (npm)
- Feb 19, 2024
Malware in new-dependency-test
1 compromised version
- Feb 19, 2024
Malware in uber-rv-web-common
1 compromised version
- Feb 19, 2024
Malicious code in uber-rv-web-common-virtual-8d2dce4f55 (npm)
- Feb 19, 2024
Malicious code in ppui4theme (npm)
- Feb 19, 2024
Malware in ppui4theme
1 compromised version
- Feb 19, 2024
Malware in uber-rv-web-common-virtual-8d2dce4f55
1 compromised version
- Feb 19, 2024
Malicious code in ts-patch-moongoose (npm)
2 compromised versions
- Feb 19, 2024
Malicious code in ts-patch-mongoos (npm)
2 compromised versions
- Feb 19, 2024
Malware in ts-patch-mongoos
1 compromised version
- Feb 19, 2024
Malware in ts-patch-moongoose
1 compromised version
- Feb 19, 2024
Malware in evilcalendar
1 compromised version
- Feb 19, 2024
Malware in ts-patch-mongose
1 compromised version
- Feb 18, 2024
Malicious code in analysis-shared-utils (npm)
2 compromised versions
- Feb 18, 2024
Malicious code in analysis-components (npm)
1 compromised version
- Feb 18, 2024
Malicious code in analysis-tool-app (npm)
2 compromised versions
- Feb 18, 2024
Malicious code in analysis-studio-components (npm)
3 compromised versions
- Feb 18, 2024
Malicious code in lol-pizda (npm)
1 compromised version
- Feb 18, 2024
Malicious code in lol-huy (npm)
1 compromised version
- Feb 16, 2024
Malicious code in harbor-container-webhook (npm)
1 compromised version
- Feb 15, 2024
Malicious code in execution-time-async (npm)
- Feb 15, 2024
Malware in execution-time-async
1 compromised version
- Feb 15, 2024
Malicious code in @dh-io-globalelem/footnote-reference-component (npm)
2 compromised versions
- Feb 15, 2024
Malicious code in @dh-io-globalelem/footnote-component (npm)
1 compromised version
- Feb 15, 2024
Malicious code in @ebay/ui-core-react (npm)
7 compromised versions
- Feb 15, 2024
Malicious code in ts-patch-mongose (npm)
2 compromised versions
- Feb 15, 2024
Malicious code in evilcalendar (npm)
1 compromised version
- Feb 15, 2024
Malicious code in rb-web-popup (npm)
1 compromised version
- Feb 14, 2024
Malicious code in custom-solutions (npm)
3 compromised versions
- Feb 14, 2024
Malicious code in blockledger (npm)
- Feb 14, 2024
Malware in blockledger
1 compromised version
- Feb 14, 2024
Malicious code in erc20-testenv (npm)
- Feb 14, 2024
Malware in erc20-testenv
1 compromised version
- Feb 13, 2024
Malicious code in wickrserverdirectory (npm)
1 compromised version
- Feb 12, 2024
Malicious code in vtuancuti (npm)
- Feb 12, 2024
Malicious code in hanncuti (npm)
- Feb 12, 2024
Malware in vtuancuti
1 compromised version
- Feb 12, 2024
Malware in hanncuti
1 compromised version
- Feb 12, 2024
Malicious code in vtuanhihi (npm)
Page 6747 of 7,293