Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,237 total · sorted newest first- Oct 31, 2023
Malicious code in shithandlers (npm)
1 compromised version
- Oct 31, 2023
Malicious code in djsmusiccc (npm)
1 compromised version
- Oct 31, 2023
Malware in z-dsm
1 compromised version
- Oct 31, 2023
Malware in editor-layer-index
1 compromised version
- Oct 31, 2023
Malware in fuzzer-gui
1 compromised version
- Oct 31, 2023
Malware in by-helpers
1 compromised version
- Oct 31, 2023
Malicious code in fadam-com-test-1 (npm)
1 compromised version
- Oct 31, 2023
Malware in fadam-com-test-1
1 compromised version
- Oct 31, 2023
Malware in kraken-frontend
1 compromised version
- Oct 30, 2023
Malicious code in discordwebutils1 (npm)
1 compromised version
- Oct 30, 2023
Malicious code in hydradx-ui (npm)
3 compromised versions
- Oct 29, 2023
Malicious code in eslint-plugin-blade (npm)
3 compromised versions
- Oct 28, 2023
Malicious code in sparkonto-plus-external-web-app (npm)
2 compromised versions
- Oct 28, 2023
Malicious code in kraken-frontend (npm)
1 compromised version
- Oct 27, 2023
Malicious code in fuzzer-gui (npm)
2 compromised versions
- Oct 27, 2023
Malicious code in fadam-frontend (npm)
1 compromised version
- Oct 27, 2023
Malware in @bitsoex/react-design-system
1 compromised version
- Oct 25, 2023
Malicious code in envision-config (npm)
- Oct 25, 2023
Malicious code in envi-conf (npm)
- Oct 25, 2023
Malware in envi-conf
1 compromised version
- Oct 25, 2023
Malware in envision-config
1 compromised version
- Oct 24, 2023
Malicious code in @tpci/i18next-ext (npm)
1 compromised version
- Oct 24, 2023
Malicious code in i18next-ext (npm)
1 compromised version
- Oct 24, 2023
Malicious code in fec-sdk (npm)
1 compromised version
- Oct 24, 2023
Malware in proofing
1 compromised version
- Oct 23, 2023
Malicious code in fbdebug (PyPI)
1 compromised version
- Oct 23, 2023
Malicious code in billing.api (npm)
1 compromised version
- Oct 23, 2023
Malicious code in npm-research-enum (npm)
1 compromised version
- Oct 23, 2023
Malicious code in z-dsm (npm)
3 compromised versions
- Oct 21, 2023
Malicious code in ux-website (npm)
1 compromised version
- Oct 20, 2023
Malware in @rappiinc/partner-core
1 compromised version
- Oct 20, 2023
Malicious code in @banana-cake-pop/data (npm)
1 compromised version
- Oct 20, 2023
Malware in @ltd2research/tldrequest
1 compromised version
- Oct 19, 2023
Malicious code in @rappiinc/partner-core (npm)
1 compromised version
- Oct 19, 2023
Malicious code in @syska/aca-gui (npm)
2 compromised versions
- Oct 16, 2023
Malicious code in very-bad-npm_uwu (npm)
- Oct 16, 2023
Malicious code in very-bad-npm-package2 (npm)
- Oct 16, 2023
Malicious code in very-bad-npm-package (npm)
- Oct 16, 2023
Malicious code in very-bad-npm (npm)
- Oct 16, 2023
Malware in very-bad-npm-package
1 compromised version
- Oct 16, 2023
Malware in very-bad-npm-package2
1 compromised version
- Oct 16, 2023
Malware in very-bad-npm
1 compromised version
- Oct 16, 2023
Malware in very-bad-npm_uwu
1 compromised version
- Oct 16, 2023
Malicious code in kempremium-dev (npm)
- Oct 16, 2023
Malicious code in fca-kemdino (npm)
- Oct 16, 2023
Malicious code in fca-kemdev (npm)
- Oct 16, 2023
Malicious code in data-kempremium (npm)
- Oct 16, 2023
Malware in fca-kemdev
1 compromised version
- Oct 16, 2023
Malware in fca-kemdino
1 compromised version
- Oct 16, 2023
Malware in kempremium-dev
1 compromised version
Page 6810 of 7,305