Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,237 total · sorted newest first- Nov 7, 2023
Malicious code in react-18-viem (npm)
1 compromised version
- Nov 7, 2023
Malicious code in vanillajs-test (npm)
2 compromised versions
- Nov 6, 2023
Malicious code in tst-atk (npm)
7 compromised versions
- Nov 6, 2023
Malicious code in cms-flypage-components (npm)
- Nov 6, 2023
Malware in atmos-design-system
1 compromised version
- Nov 6, 2023
Malware in cms-flypage-components
1 compromised version
- Nov 6, 2023
Malicious code in workspaces-install-already-exists (npm)
- Nov 6, 2023
Malicious code in turbolinks-tests (npm)
- Nov 6, 2023
Malicious code in share-client (npm)
- Nov 6, 2023
Malicious code in print-vault-browser (npm)
- Nov 6, 2023
Malicious code in ksm-action (npm)
- Nov 6, 2023
Malicious code in inventashif (npm)
- Nov 6, 2023
Malicious code in frontegg-react-sanity-check (npm)
- Nov 6, 2023
Malicious code in creators-landing (npm)
- Nov 6, 2023
Malicious code in classnames-benchmarks (npm)
- Nov 6, 2023
Malicious code in @inventashif/workspace-1 (npm)
1 compromised version
- Nov 6, 2023
Malware in symphony-vega
1 compromised version
- Nov 6, 2023
Malware in classnames-benchmarks
1 compromised version
- Nov 6, 2023
Malware in symphony-list
1 compromised version
- Nov 6, 2023
Malware in ksm-action
1 compromised version
- Nov 6, 2023
Malware in qlkube-client
1 compromised version
- Nov 6, 2023
Malware in workspaces-install-already-exists
1 compromised version
- Nov 6, 2023
Malware in @inventashif/workspace-1
1 compromised version
- Nov 6, 2023
Malware in gatsby-starter-gitlab
1 compromised version
- Nov 6, 2023
Malware in inventashif
1 compromised version
- Nov 6, 2023
Malware in demo-saas
1 compromised version
- Nov 6, 2023
Malware in creators-landing
1 compromised version
- Nov 6, 2023
Malware in print-vault-browser
1 compromised version
- Nov 6, 2023
Malware in tvaultuiv2
1 compromised version
- Nov 6, 2023
Malware in stripe-terminal-react-native-dev-app
1 compromised version
- Nov 6, 2023
Malware in frontegg-react-sanity-check
1 compromised version
- Nov 6, 2023
Malware in ironfish-rust-nodejs
1 compromised version
- Nov 6, 2023
Malware in share-client
1 compromised version
- Nov 6, 2023
Malware in watchman-search-ui
1 compromised version
- Nov 6, 2023
Malware in turbolinks-tests
1 compromised version
- Nov 6, 2023
Malware in transaction-decoder
1 compromised version
- Nov 6, 2023
Malware in oathkeeper
1 compromised version
- Nov 6, 2023
Malicious code in odn-static-assets (npm)
1 compromised version
- Nov 6, 2023
Malware in odn-static-assets
1 compromised version
- Nov 6, 2023
Malicious code in fa-icdc-form-api-bdt (npm)
1 compromised version
- Nov 6, 2023
Malicious code in bt8-wax-front-lib (npm)
1 compromised version
- Nov 6, 2023
Malware in bt8-wax-front-lib
1 compromised version
- Nov 6, 2023
Malware in fa-icdc-form-api-bdt
1 compromised version
- Nov 6, 2023
Malicious code in redux-modal-dispatcher (npm)
1 compromised version
- Nov 6, 2023
Malicious code in airslate-static.icons (npm)
1 compromised version
- Nov 6, 2023
Malicious code in airslate-static (npm)
1 compromised version
- Nov 6, 2023
Malware in redux-modal-dispatcher
1 compromised version
- Nov 6, 2023
Malware in airslate-static.icons
1 compromised version
- Nov 6, 2023
Malware in airslate-static
1 compromised version
- Nov 6, 2023
Malicious code in airslate-image-uploader (npm)
1 compromised version
Page 6808 of 7,305