Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,842 total · sorted newest first- Jan 31, 2024
Malware in ent-cas-services
1 compromised version
- Jan 31, 2024
Malicious code in diil-selfservice-components (npm)
1 compromised version
- Jan 31, 2024
Malicious code in diil-front (npm)
1 compromised version
- Jan 31, 2024
Malware in diil-front
1 compromised version
- Jan 31, 2024
Malware in diil-selfservice-components
1 compromised version
- Jan 30, 2024
Malicious code in moblig-npm (npm)
2 compromised versions
- Jan 30, 2024
Malicious code in dragon7-dc-vulntest (npm)
1 compromised version
- Jan 29, 2024
Malicious code in wlwz-2312-2nd (npm)
- Jan 29, 2024
Malware in wlwz-2312-2nd
1 compromised version
- Jan 29, 2024
Malicious code in samsungads-publisher-portal-authorizer (npm)
1 compromised version
- Jan 29, 2024
Malicious code in npm_package_dependencies_core_js (npm)
1 compromised version
- Jan 29, 2024
Malicious code in npm_package_dependencies_linkify_it (npm)
1 compromised version
- Jan 29, 2024
Malicious code in npm_package_dependencies_promise_polyfill (npm)
1 compromised version
- Jan 29, 2024
Malicious code in npm_package_dependencies_regenerator_runtime (npm)
2 compromised versions
- Jan 29, 2024
Malware in discord.js-sound
1 compromised version
- Jan 29, 2024
Malicious code in take-cam (npm)
- Jan 29, 2024
Malicious code in russiapi (npm)
- Jan 29, 2024
Malicious code in jewishapi (npm)
- Jan 29, 2024
Malware in take-cam
1 compromised version
- Jan 29, 2024
Malware in jewishapi
1 compromised version
- Jan 29, 2024
Malware in russiapi
1 compromised version
- Jan 29, 2024
Malicious code in discord.js-dmall-v11 (npm)
- Jan 29, 2024
Malware in discord.js-dmall-v11
1 compromised version
- Jan 29, 2024
Malicious code in dsc-fetcher (npm)
- Jan 29, 2024
Malware in dsc-fetcher
1 compromised version
- Jan 29, 2024
Malicious code in o2-ionic-image-loader-v7 (npm)
- Jan 29, 2024
Malicious code in o2-ionic-image-loader (npm)
- Jan 29, 2024
Malicious code in myonlife1 (npm)
- Jan 29, 2024
Malicious code in myonlife (npm)
- Jan 29, 2024
Malicious code in myoimanshhu (npm)
- Jan 29, 2024
Malware in o2-ionic-image-loader
1 compromised version
- Jan 29, 2024
Malware in myonlife
1 compromised version
- Jan 29, 2024
Malware in o2-ionic-image-loader-v7
1 compromised version
- Jan 29, 2024
Malware in myoimanshhu
1 compromised version
- Jan 29, 2024
Malware in myonlife1
1 compromised version
- Jan 29, 2024
Malware in uui-framework
1 compromised version
- Jan 29, 2024
Malicious code in web-ai-51pwn (npm)
- Jan 29, 2024
Malicious code in iifl_serialize (npm)
- Jan 29, 2024
Malicious code in iifl_ios_app (npm)
- Jan 29, 2024
Malicious code in iifl_express_middleware (npm)
- Jan 29, 2024
Malicious code in iifl_cloud (npm)
- Jan 29, 2024
Malicious code in iifl_api (npm)
- Jan 29, 2024
Malicious code in iifl_android_app (npm)
- Jan 29, 2024
Malicious code in arduino-ide-extension (npm)
2 compromised versions
- Jan 29, 2024
Malware in iifl_serialize
1 compromised version
- Jan 29, 2024
Malware in iifl_api
1 compromised version
- Jan 29, 2024
Malware in web-ai-51pwn
1 compromised version
- Jan 29, 2024
Malware in iifl_ios_app
1 compromised version
- Jan 29, 2024
Malware in iifl_express_middleware
1 compromised version
- Jan 29, 2024
Malware in iifl_cloud
1 compromised version
Page 6754 of 7,297