Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,620 total · sorted newest first- Feb 12, 2024
Malicious code in vtuandz00 (npm)
- Feb 12, 2024
Malicious code in disme (npm)
- Feb 12, 2024
Malware in vtuandz00
1 compromised version
- Feb 12, 2024
Malware in vtuanhihi
1 compromised version
- Feb 12, 2024
Malware in disme
1 compromised version
- Feb 12, 2024
Malware in @globalsearch/abstraction
1 compromised version
- Feb 12, 2024
Malware in @globalsearch/productstub
1 compromised version
- Feb 12, 2024
Malware in iris-front-test-utils
1 compromised version
- Feb 12, 2024
Malicious code in evernote-ink (npm)
1 compromised version
- Feb 12, 2024
Malicious code in en-task-helpers (npm)
2 compromised versions
- Feb 12, 2024
Malicious code in en-calendar (npm)
5 compromised versions
- Feb 11, 2024
Malicious code in webnotekc0506 (npm)
- Feb 11, 2024
Malware in webnotekc0506
1 compromised version
- Feb 10, 2024
Malicious code in crumpet (npm)
2 compromised versions
- Feb 10, 2024
Malicious code in @globalsearch/abstraction (npm)
1 compromised version
- Feb 10, 2024
Malicious code in @globalsearch/productstub (npm)
1 compromised version
- Feb 9, 2024
Malicious code in iris-front-test-utils (npm)
1 compromised version
- Feb 9, 2024
Malicious code in prism-commercial-ui (npm)
13 compromised versions
- Feb 8, 2024
Malicious code in privdel (npm)
1 compromised version
- Feb 7, 2024
Malicious code in styled-compoment (npm)
- Feb 7, 2024
Malicious code in dependency-ab (npm)
- Feb 7, 2024
Malware in styled-compoment
1 compromised version
- Feb 7, 2024
Malware in dependency-ab
1 compromised version
- Feb 7, 2024
Malicious code in paradis (npm)
- Feb 7, 2024
Malicious code in nhatcoder-fb-api (npm)
- Feb 7, 2024
Malware in paradis
1 compromised version
- Feb 7, 2024
Malware in nhatcoder-fb-api
1 compromised version
- Feb 7, 2024
Malicious code in @bughunter0007/packages-analytics (npm)
3 compromised versions
- Feb 7, 2024
Malicious code in packages-analytic (npm)
1 compromised version
- Feb 7, 2024
Malicious code in discord.js-commandv14.1 (npm)
1 compromised version
- Feb 7, 2024
Malicious code in packages-analytics (npm)
1 compromised version
- Feb 7, 2024
Malicious code in internal-corp-package (npm)
1 compromised version
- Feb 7, 2024
Malicious code in discord.js-commandv14 (npm)
1 compromised version
- Feb 7, 2024
Malware in jera
1 compromised version
- Feb 7, 2024
Malicious code in test-pkg1-random (npm)
- Feb 7, 2024
Malicious code in can-explorer (npm)
- Feb 7, 2024
Malware in can-explorer
1 compromised version
- Feb 7, 2024
Malware in test-pkg1-random
1 compromised version
- Feb 6, 2024
Malicious code in @ssr-frontend/packages-analytics (npm)
6 compromised versions
- Feb 6, 2024
Malicious code in bug-test-package (npm)
- Feb 6, 2024
Malicious code in auto-issues (npm)
5 compromised versions
- Feb 6, 2024
Malware in auto-issues
1 compromised version
- Feb 6, 2024
Malware in bug-test-package
1 compromised version
- Feb 5, 2024
Malicious code in ngpd-merceros-ui-widget-core (npm)
- Feb 5, 2024
Malicious code in ngpd-merceros-ui-meta (npm)
- Feb 5, 2024
Malicious code in ngpd-merceros-dynamic-forms-fe-components (npm)
- Feb 5, 2024
Malicious code in health-gbm-common (npm)
- Feb 5, 2024
Malware in ngpd-merceros-dynamic-forms-fe-components
1 compromised version
- Feb 5, 2024
Malware in ngpd-merceros-ui-widget-core
1 compromised version
- Feb 5, 2024
Malware in health-gbm-common
1 compromised version
Page 6748 of 7,293