Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,885 total · sorted newest first- Feb 23, 2024
Malicious code in djanggo (PyPI)
2 compromised versions
- Feb 22, 2024
Malicious code in fekirinetest3 (npm)
1 compromised version
- Feb 22, 2024
Malicious code in xo-page-components (npm)
2 compromised versions
- Feb 21, 2024
Malicious code in disc-web-sender (npm)
- Feb 21, 2024
Malware in disc-web-sender
1 compromised version
- Feb 21, 2024
Malicious code in uikit-dark-mode (npm)
1 compromised version
- Feb 21, 2024
Malicious code in testconfusiontestt (npm)
- Feb 21, 2024
Malicious code in scytheetest (npm)
- Feb 21, 2024
Malicious code in node-red-contrib-object-to-array (npm)
- Feb 21, 2024
Malware in node-red-contrib-object-to-array
1 compromised version
- Feb 21, 2024
Malware in scytheetest
1 compromised version
- Feb 21, 2024
Malware in testconfusiontestt
1 compromised version
- Feb 21, 2024
Malicious code in ember-power-calendar-dayjs (npm)
- Feb 21, 2024
Malware in ember-power-calendar-dayjs
1 compromised version
- Feb 20, 2024
Malicious code in djs-colors-v14 (npm)
2 compromised versions
- Feb 20, 2024
Malware in djs-colors-v14
1 compromised version
- Feb 20, 2024
Malicious code in eslint-plugin-unicorn-ts-2 (npm)
1 compromised version
- Feb 20, 2024
Malicious code in confusiontestt (npm)
1 compromised version
- Feb 20, 2024
Malicious code in ent-profile-api-client (npm)
1 compromised version
- Feb 20, 2024
Malicious code in usaa-wdio-utils (npm)
1 compromised version
- Feb 20, 2024
Malware in analysis-tool-app
1 compromised version
- Feb 20, 2024
Malware in analysis-shared-utils
1 compromised version
- Feb 20, 2024
Malware in lol-pizda
1 compromised version
- Feb 20, 2024
Malware in analysis-components
1 compromised version
- Feb 20, 2024
Malware in analysis-studio-components
1 compromised version
- Feb 19, 2024
Malicious code in uber-rv-web-common (npm)
- Feb 19, 2024
Malicious code in new-dependency-test (npm)
- Feb 19, 2024
Malware in new-dependency-test
1 compromised version
- Feb 19, 2024
Malware in uber-rv-web-common
1 compromised version
- Feb 19, 2024
Malicious code in uber-rv-web-common-virtual-8d2dce4f55 (npm)
- Feb 19, 2024
Malicious code in ppui4theme (npm)
- Feb 19, 2024
Malware in ppui4theme
1 compromised version
- Feb 19, 2024
Malware in uber-rv-web-common-virtual-8d2dce4f55
1 compromised version
- Feb 19, 2024
Malicious code in ts-patch-moongoose (npm)
2 compromised versions
- Feb 19, 2024
Malicious code in ts-patch-mongoos (npm)
2 compromised versions
- Feb 19, 2024
Malware in ts-patch-mongoos
1 compromised version
- Feb 19, 2024
Malware in ts-patch-moongoose
1 compromised version
- Feb 19, 2024
Malware in evilcalendar
1 compromised version
- Feb 19, 2024
Malware in ts-patch-mongose
1 compromised version
- Feb 18, 2024
Malicious code in analysis-shared-utils (npm)
2 compromised versions
- Feb 18, 2024
Malicious code in analysis-components (npm)
1 compromised version
- Feb 18, 2024
Malicious code in analysis-tool-app (npm)
2 compromised versions
- Feb 18, 2024
Malicious code in analysis-studio-components (npm)
3 compromised versions
- Feb 18, 2024
Malicious code in lol-pizda (npm)
1 compromised version
- Feb 18, 2024
Malicious code in lol-huy (npm)
1 compromised version
- Feb 16, 2024
Malicious code in harbor-container-webhook (npm)
1 compromised version
- Feb 15, 2024
Malicious code in execution-time-async (npm)
- Feb 15, 2024
Malware in execution-time-async
1 compromised version
- Feb 15, 2024
Malicious code in @dh-io-globalelem/footnote-reference-component (npm)
2 compromised versions
- Feb 15, 2024
Malicious code in @dh-io-globalelem/footnote-component (npm)
1 compromised version
Page 6752 of 7,298