Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,237 total · sorted newest first- Nov 21, 2023
Malware in footnote-component
1 compromised version
- Nov 21, 2023
Malicious code in wehackreposss (npm)
1 compromised version
- Nov 21, 2023
Malicious code in logpeck (npm)
1 compromised version
- Nov 21, 2023
Malicious code in one-host-page-title-management (npm)
1 compromised version
- Nov 21, 2023
Malicious code in autocomplete-ui (npm)
- Nov 21, 2023
Malware in autocomplete-ui
1 compromised version
- Nov 21, 2023
Malware in one-host-page-title-management
1 compromised version
- Nov 21, 2023
Malware in ifl-components
1 compromised version
- Nov 21, 2023
Malware in autocomplete-core
1 compromised version
- Nov 21, 2023
Malware in frontend-components-react-transpiled
1 compromised version
- Nov 21, 2023
Malware in ifl-icons
1 compromised version
- Nov 21, 2023
Malware in node-common-npm-scripts
1 compromised version
- Nov 21, 2023
Malware in frontend-style-janus
1 compromised version
- Nov 21, 2023
Malware in one-host-app-context
1 compromised version
- Nov 21, 2023
Malware in f0-components
1 compromised version
- Nov 21, 2023
Malware in spring-boot-admin-virgil-custom-ui
1 compromised version
- Nov 21, 2023
Malicious code in alok-test123 (npm)
1 compromised version
- Nov 20, 2023
Malicious code in discord.js-song (npm)
2 compromised versions
- Nov 20, 2023
Malicious code in xfinity-web (npm)
1 compromised version
- Nov 20, 2023
Malicious code in linktr.ee (npm)
1 compromised version
- Nov 20, 2023
Malicious code in cobrowse-visitor (npm)
1 compromised version
- Nov 20, 2023
Malware in linktr.ee
1 compromised version
- Nov 20, 2023
Malware in carvana
1 compromised version
- Nov 20, 2023
Malware in cobrowse-visitor
1 compromised version
- Nov 20, 2023
Malware in xfinity-web
1 compromised version
- Nov 20, 2023
Malware in schibsted-ufo
1 compromised version
- Nov 20, 2023
Malware in spotify-internal
1 compromised version
- Nov 20, 2023
Malicious code in nintendo-of-europe (npm)
1 compromised version
- Nov 20, 2023
Malicious code in customer-journey-socket (npm)
1 compromised version
- Nov 20, 2023
Malware in customer-journey-socket
1 compromised version
- Nov 20, 2023
Malware in nintendo-of-europe
1 compromised version
- Nov 20, 2023
Malware in shein-lego
1 compromised version
- Nov 20, 2023
Malware in oasis-auth
1 compromised version
- Nov 20, 2023
Malware in oasis-os-react
1 compromised version
- Nov 20, 2023
Malware in bds-ng
1 compromised version
- Nov 20, 2023
Malware in discord-web-stream.js
1 compromised version
- Nov 20, 2023
Malware in discord-web-stream
1 compromised version
- Nov 19, 2023
Malicious code in mxtorie-prevname (npm)
1 compromised version
- Nov 19, 2023
Malicious code in mxtorie-api (npm)
3 compromised versions
- Nov 18, 2023
Malicious code in ifl-icons (npm)
1 compromised version
- Nov 18, 2023
Malicious code in node-common-npm-scripts (npm)
2 compromised versions
- Nov 18, 2023
Malicious code in autocomplete-core (npm)
1 compromised version
- Nov 18, 2023
Malicious code in frontend-components-react-transpiled (npm)
1 compromised version
- Nov 18, 2023
Malicious code in discomusic (PyPI)
1 compromised version
- Nov 18, 2023
Malicious code in xpub-lib (npm)
1 compromised version
- Nov 18, 2023
Malicious code in jobserver (npm)
1 compromised version
- Nov 18, 2023
Malicious code in vpc-nat-gateway-dependency (npm)
1 compromised version
- Nov 17, 2023
Malicious code in ifl-components (npm)
1 compromised version
- Nov 17, 2023
Malicious code in f0-components (npm)
2 compromised versions
- Nov 17, 2023
Malicious code in vehicle-data-store-connection (npm)
1 compromised version
Page 6805 of 7,305