Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,237 total · sorted newest first- Jan 2, 2024
Malicious code in @skip-js/cookie-consent (npm)
1 compromised version
- Jan 2, 2024
Malicious code in @serenity-web/components-base (npm)
- Jan 2, 2024
Malicious code in @serenity-web/common-helpers (npm)
- Jan 2, 2024
Malicious code in @serenity-web/common-assets (npm)
- Jan 2, 2024
Malicious code in @serenity-web/channel-motor (npm)
- Jan 2, 2024
Malware in @serenity-web/channel-motor
1 compromised version
- Jan 2, 2024
Malware in @serenity-web/common-helpers
1 compromised version
- Jan 2, 2024
Malware in @serenity-web/components-base
1 compromised version
- Jan 2, 2024
Malware in @serenity-web/common-assets
1 compromised version
- Jan 2, 2024
Malicious code in @msmg-money/vue-datadog (npm)
2 compromised versions
- Jan 2, 2024
Malware in @msmg-money/vue-datadog
1 compromised version
- Jan 2, 2024
Malicious code in @msmg-money/get-current-env (npm)
2 compromised versions
- Jan 2, 2024
Malware in @msmg-money/get-current-env
1 compromised version
- Jan 2, 2024
Malicious code in @authentication-pages/vue-cli-prebuild (npm)
- Jan 2, 2024
Malware in @authentication-pages/vue-cli-prebuild
1 compromised version
- Jan 2, 2024
Malicious code in obiz (npm)
- Jan 2, 2024
Malware in unit-testing-controllers
1 compromised version
- Jan 2, 2024
Malware in obiz
1 compromised version
- Jan 1, 2024
Malicious code in @cartus-core/cartus-common-ui2 (npm)
2 compromised versions
- Jan 1, 2024
Malicious code in new-pro-anu (npm)
5 compromised versions
- Jan 1, 2024
Malicious code in hubl-parser (npm)
1 compromised version
- Jan 1, 2024
Malicious code in @cartus-core/cartus-common-ui (npm)
11 compromised versions
- Jan 1, 2024
Malicious code in squaredev-next-online-payments-example (npm)
1 compromised version
- Dec 31, 2023
Malicious code in ngx-ndbx (npm)
2 compromised versions
- Dec 31, 2023
Malicious code in sparxy (npm)
2 compromised versions
- Dec 30, 2023
Malicious code in discord.js-self-v22 (npm)
1 compromised version
- Dec 30, 2023
Malicious code in unit-testing-controllers (npm)
1 compromised version
- Dec 29, 2023
Malicious code in @chainxxx/act-utils (npm)
- Dec 29, 2023
Malware in @chainxxx/act-utils
1 compromised version
- Dec 29, 2023
Malicious code in chain00x (npm)
- Dec 29, 2023
Malware in chain00x
1 compromised version
- Dec 29, 2023
Malicious code in tsrcrcetest1 (npm)
1 compromised version
- Dec 29, 2023
Malicious code in rcetest (npm)
1 compromised version
- Dec 29, 2023
Malicious code in chain00x_rce (npm)
1 compromised version
- Dec 29, 2023
Malicious code in holland (npm)
- Dec 29, 2023
Malware in holland
1 compromised version
- Dec 28, 2023
Malicious code in sd-v13.js (npm)
- Dec 28, 2023
Malicious code in discord.js-v13-selbots (npm)
- Dec 28, 2023
Malicious code in discord.js-selfbots-v13 (npm)
- Dec 28, 2023
Malware in sd-v13.js
1 compromised version
- Dec 28, 2023
Malware in discord.js-selfbots-v13
1 compromised version
- Dec 28, 2023
Malware in discord.js-v13-selbots
1 compromised version
- Dec 28, 2023
Malicious code in lockself (npm)
2 compromised versions
- Dec 28, 2023
Malicious code in discord.js-selfbot-dmallfriend-v13 (npm)
- Dec 28, 2023
Malicious code in discord.js-selbotderank (npm)
- Dec 28, 2023
Malware in discord.js-selfbot-dmallfriend-v13
1 compromised version
- Dec 28, 2023
Malware in discord.js-selbotderank
1 compromised version
- Dec 28, 2023
Malware in lockself
1 compromised version
- Dec 28, 2023
Malware in biscits
1 compromised version
- Dec 28, 2023
Malware in spectrum-utils
1 compromised version
Page 6798 of 7,305