Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,237 total · sorted newest first- Jan 11, 2024
Malware in dynatrace-oneagent-nodejs
1 compromised version
- Jan 11, 2024
Malware in nylas-sync
1 compromised version
- Jan 11, 2024
Malware in cloudflare-docs-theme
1 compromised version
- Jan 11, 2024
Malware in replit-extensions-react
1 compromised version
- Jan 11, 2024
Malware in akshansh-jaiswal-ctf
1 compromised version
- Jan 11, 2024
Malware in nylas-core
1 compromised version
- Jan 11, 2024
Malicious code in schibsted-style (npm)
3 compromised versions
- Jan 11, 2024
Malware in schibsted-style
1 compromised version
- Jan 11, 2024
Malware in error-can-not-resolve-resource
1 compromised version
- Jan 11, 2024
Malware in deep-search-exports-directory
1 compromised version
- Jan 11, 2024
Malware in vg-bot
1 compromised version
- Jan 11, 2024
Malware in bakery-dashboard
1 compromised version
- Jan 11, 2024
Malicious code in sh.keptn.core.control (npm)
- Jan 11, 2024
Malicious code in keptnwebservice (npm)
1 compromised version
- Jan 11, 2024
Malicious code in gh-action-send-event (npm)
1 compromised version
- Jan 11, 2024
Malicious code in automation.samples (npm)
3 compromised versions
- Jan 11, 2024
Malware in gh-action-send-event
1 compromised version
- Jan 11, 2024
Malware in keptnwebservice
1 compromised version
- Jan 11, 2024
Malware in automation.samples
1 compromised version
- Jan 11, 2024
Malware in sh.keptn.core.control
1 compromised version
- Jan 11, 2024
Malicious code in cordova-plugin-canvas (npm)
1 compromised version
- Jan 11, 2024
Malware in cordova-plugin-canvas
1 compromised version
- Jan 11, 2024
Malicious code in @snip3rxd/ocore (npm)
1 compromised version
- Jan 11, 2024
Malware in @snip3rxd/ocore
1 compromised version
- Jan 10, 2024
Malicious code in @neogov/linkanx (npm)
1 compromised version
- Jan 10, 2024
Malicious code in test-devoxx (npm)
2 compromised versions
- Jan 10, 2024
Malicious code in internal-test-devoxx (npm)
1 compromised version
- Jan 10, 2024
Malicious code in eslint-plugin-unicorn-ts (npm)
1 compromised version
- Jan 10, 2024
Malware in schedules-oauth-itwin
1 compromised version
- Jan 10, 2024
Malware in raspeditor
1 compromised version
- Jan 10, 2024
Malware in @monokera/react-components-storybook
1 compromised version
- Jan 10, 2024
Malware in axis-common-lib
1 compromised version
- Jan 10, 2024
Malicious code in webrtc-studio-connection (npm)
1 compromised version
- Jan 10, 2024
Malware in webrtc-studio-connection
1 compromised version
- Jan 10, 2024
Malware in d5-es6-sass-boilerplate
1 compromised version
- Jan 10, 2024
Malware in holamessironaldo
1 compromised version
- Jan 10, 2024
Malicious code in @jitoz/encrypted-tools (npm)
- Jan 10, 2024
Malware in @jitoz/encrypted-tools
1 compromised version
- Jan 10, 2024
Malicious code in @linesearch/swiper (npm)
- Jan 10, 2024
Malware in @linesearch/swiper
1 compromised version
- Jan 9, 2024
Malicious code in sourcify-ui (npm)
1 compromised version
- Jan 9, 2024
Malicious code in onetake (npm)
2 compromised versions
- Jan 8, 2024
Malicious code in demo-store (npm)
1 compromised version
- Jan 8, 2024
Malicious code in optimistic-cart-ui (npm)
1 compromised version
- Jan 8, 2024
Malicious code in vg-bot (npm)
2 compromised versions
- Jan 8, 2024
Malicious code in essentialist-gallery-block-cgb-guten-block (npm)
1 compromised version
- Jan 8, 2024
Malicious code in j5-test (npm)
1 compromised version
- Jan 7, 2024
Malicious code in ember-cli-progress-ci (npm)
1 compromised version
- Jan 7, 2024
Malicious code in dont-install-me-1 (npm)
1 compromised version
- Jan 7, 2024
Malicious code in dont-install-me0 (npm)
1 compromised version
Page 6796 of 7,305