Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,056 total · sorted newest first- Apr 2, 2024
Malicious code in paysafe-gpf-as-communication-lib-fe (npm)
1 compromised version
- Apr 2, 2024
Malware in paysafe-gpf-as-communication-lib-fe
1 compromised version
- Apr 2, 2024
Malware in paysafe-gpf-as-http-proxy-middleware-body-replace
1 compromised version
- Apr 1, 2024
Malicious code in vue2util (npm)
- Apr 1, 2024
Malware in vue2util
1 compromised version
- Apr 1, 2024
Malicious code in hds-input (npm)
1 compromised version
- Apr 1, 2024
Malicious code in iotnet (npm)
1 compromised version
- Apr 1, 2024
Malicious code in soundcloud-songs (npm)
2 compromised versions
- Mar 31, 2024
Malicious code in galileo-web-sdk (npm)
6 compromised versions
- Mar 31, 2024
Malicious code in poptoken-builder-node (npm)
1 compromised version
- Mar 31, 2024
Malicious code in secrets-management (npm)
1 compromised version
- Mar 31, 2024
Malicious code in bugsnagmw (npm)
4 compromised versions
- Mar 31, 2024
Malicious code in fe-bitmovin-player (npm)
1 compromised version
- Mar 31, 2024
Malicious code in optus-sport-ctv (npm)
1 compromised version
- Mar 31, 2024
Malicious code in cds-banking-prd-viewer (npm)
1 compromised version
- Mar 31, 2024
Malicious code in amcharts-accessibility-plugin (npm)
1 compromised version
- Mar 30, 2024
Malicious code in xko2x (npm)
1 compromised version
- Mar 29, 2024
Malicious code in tchap-translations (npm)
2 compromised versions
- Mar 29, 2024
Malicious code in wm-search-deployables (npm)
2 compromised versions
- Mar 29, 2024
Malicious code in shelllib (npm)
2 compromised versions
- Mar 29, 2024
Malicious code in u-workflow.module.common.hour-of-week (npm)
1 compromised version
- Mar 27, 2024
Malware in commandlib
1 compromised version
- Mar 27, 2024
Malicious code in createarrayfrommixed (npm)
1 compromised version
- Mar 27, 2024
Malicious code in sparklog (PyPI)
1 compromised version
- Mar 27, 2024
Malicious code in types-for-adobe (PyPI)
2 compromised versions
- Mar 27, 2024
Malicious code in programmablesearchengine (npm)
1 compromised version
- Mar 27, 2024
Malicious code in region-optimizer (npm)
2 compromised versions
- Mar 27, 2024
Malicious code in @fin-php/npms (npm)
1 compromised version
- Mar 27, 2024
Malicious code in teslamotors-server (npm)
1 compromised version
- Mar 27, 2024
Malicious code in mytmobile (npm)
1 compromised version
- Mar 27, 2024
Malicious code in routepair (npm)
- Mar 27, 2024
Malware in routepair
1 compromised version
- Mar 27, 2024
Malicious code in google-requests (npm)
1 compromised version
- Mar 26, 2024
Malicious code in commandlib (npm)
2 compromised versions
- Mar 26, 2024
Malicious code in gatsby-theme-deriv (npm)
1 compromised version
- Mar 24, 2024
Malicious code in trujillocheck (npm)
- Mar 24, 2024
Malicious code in hessskinchecker (npm)
- Mar 24, 2024
Malicious code in francoadvisor (npm)
- Mar 24, 2024
Malware in francoadvisor
1 compromised version
- Mar 24, 2024
Malware in trujillocheck
1 compromised version
- Mar 24, 2024
Malware in hessskinchecker
1 compromised version
- Mar 24, 2024
Malicious code in win-regi (npm)
- Mar 24, 2024
Malicious code in gkldjdkljgdklfgj (npm)
- Mar 24, 2024
Malicious code in btcbip-39 (npm)
- Mar 24, 2024
Malware in btcbip-39
1 compromised version
- Mar 24, 2024
Malware in win-regi
1 compromised version
- Mar 24, 2024
Malware in gkldjdkljgdklfgj
1 compromised version
- Mar 24, 2024
Malicious code in odyssey-lint-staged (npm)
1 compromised version
- Mar 24, 2024
Malicious code in google-requests (PyPI)
1 compromised version
- Mar 24, 2024
Malicious code in familylink (npm)
2 compromised versions
Page 6751 of 7,302