Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,237 total · sorted newest first- Jan 24, 2024
Malware in wlwz-2311-3503
1 compromised version
- Jan 24, 2024
Malware in wlwz-2311-2105
1 compromised version
- Jan 24, 2024
Malware in wlwz-2311-0707
1 compromised version
- Jan 24, 2024
Malware in wlwz-2311-1406
1 compromised version
- Jan 24, 2024
Malware in wlwz-2311-0100
1 compromised version
- Jan 24, 2024
Malicious code in epsilonprotect (npm)
- Jan 24, 2024
Malicious code in epsilonapi (npm)
- Jan 24, 2024
Malware in epsilonapi
1 compromised version
- Jan 24, 2024
Malware in epsilonprotect
1 compromised version
- Jan 23, 2024
Malicious code in discord.js-sounds (npm)
6 compromised versions
- Jan 23, 2024
Malicious code in gothics-api (npm)
- Jan 23, 2024
Malicious code in gothic-token (npm)
- Jan 23, 2024
Malicious code in discord.js-gothic (npm)
- Jan 23, 2024
Malicious code in api-gothic (npm)
- Jan 23, 2024
Malware in gothics-api
1 compromised version
- Jan 23, 2024
Malware in gothic-token
1 compromised version
- Jan 23, 2024
Malware in discord.js-gothic
1 compromised version
- Jan 23, 2024
Malware in api-gothic
1 compromised version
- Jan 22, 2024
Malicious code in discord.js-sound (npm)
9 compromised versions
- Jan 22, 2024
Malicious code in cagov-template-development (npm)
1 compromised version
- Jan 22, 2024
Malicious code in california-state-web-template-react (npm)
1 compromised version
- Jan 22, 2024
Malicious code in orchidnet-web (npm)
1 compromised version
- Jan 22, 2024
Malicious code in cagov-template-v6 (npm)
1 compromised version
- Jan 22, 2024
Malicious code in genealogy-angular (npm)
1 compromised version
- Jan 22, 2024
Malicious code in sample-schema-mgmt (npm)
1 compromised version
- Jan 22, 2024
Malicious code in vscode-mlir (npm)
2 compromised versions
- Jan 22, 2024
Malicious code in materialxtest (npm)
1 compromised version
- Jan 22, 2024
Malicious code in djs-fetcher (npm)
- Jan 22, 2024
Malicious code in discordjs-fetcher (npm)
- Jan 22, 2024
Malware in djs-fetcher
1 compromised version
- Jan 22, 2024
Malware in discordjs-fetcher
1 compromised version
- Jan 22, 2024
Malicious code in apiv1-fetcher (npm)
- Jan 22, 2024
Malware in apiv1-fetcher
1 compromised version
- Jan 22, 2024
Malicious code in ahmadzdzdzdzddddahas (npm)
- Jan 22, 2024
Malware in ahmadzdzdzdzddddahas
1 compromised version
- Jan 21, 2024
Malicious code in syxx.js (npm)
- Jan 21, 2024
Malicious code in shenmue.js-dev (npm)
- Jan 21, 2024
Malicious code in lunar-sb.js (npm)
- Jan 21, 2024
Malware in shenmue.js-dev
1 compromised version
- Jan 21, 2024
Malware in lunar-sb.js
1 compromised version
- Jan 21, 2024
Malware in syxx.js
1 compromised version
- Jan 21, 2024
Malicious code in shenmue-dmall.js (npm)
- Jan 21, 2024
Malicious code in @shenmue_dsc/shenmue.js-stream (npm)
- Jan 21, 2024
Malicious code in @shenmue_dsc/fluent-ffmpeg-multistream-ts (npm)
- Jan 21, 2024
Malware in @shenmue_dsc/fluent-ffmpeg-multistream-ts
1 compromised version
- Jan 21, 2024
Malware in @shenmue_dsc/shenmue.js-stream
1 compromised version
- Jan 21, 2024
Malware in shenmue-dmall.js
1 compromised version
- Jan 21, 2024
Malicious code in cagov-template-v5 (npm)
2 compromised versions
- Jan 21, 2024
Malicious code in froxlor (npm)
1 compromised version
- Jan 21, 2024
Malicious code in librct (npm)
6 compromised versions
Page 6793 of 7,305