Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,217 total · sorted newest first- Sep 20, 2023
Malware in rambox
1 compromised version
- Sep 20, 2023
Malware in puppeteer-example
1 compromised version
- Sep 20, 2023
Malicious code in dot-environment (npm)
- Sep 20, 2023
Malware in dot-environment
1 compromised version
- Sep 19, 2023
Malicious code in bbc-iplayer-sounds-chatbot (npm)
3 compromised versions
- Sep 19, 2023
Malicious code in sw-kendo-atomic-theme (npm)
1 compromised version
- Sep 19, 2023
Malicious code in symphony-monorepo (npm)
1 compromised version
- Sep 19, 2023
Malicious code in rambox (npm)
1 compromised version
- Sep 19, 2023
Malicious code in team-atf-3 (npm)
- Sep 19, 2023
Malicious code in team-atf (npm)
- Sep 19, 2023
Malicious code in fca-chan (npm)
- Sep 19, 2023
Malicious code in apka-papa-chand (npm)
- Sep 19, 2023
Malware in team-atf-3
1 compromised version
- Sep 19, 2023
Malware in team-atf
1 compromised version
- Sep 19, 2023
Malware in fca-chan
1 compromised version
- Sep 19, 2023
Malware in apka-papa-chand
1 compromised version
- Sep 19, 2023
Malicious code in goingwithflow (npm)
4 compromised versions
- Sep 19, 2023
Malicious code in @fixedwidthtable/fixedwidthtable (npm)
3 compromised versions
- Sep 19, 2023
Malware in @fixedwidthtable/fixedwidthtable
1 compromised version
- Sep 19, 2023
Malicious code in @spgy/eslint-plugin-spgy-fe (npm)
- Sep 19, 2023
Malware in @spgy/eslint-plugin-spgy-fe
1 compromised version
- Sep 19, 2023
Malicious code in @virtualsearchtable/virtualsearchtable (npm)
- Sep 19, 2023
Malware in @virtualsearchtable/virtualsearchtable
1 compromised version
- Sep 19, 2023
Malicious code in simple-team-api (npm)
- Sep 19, 2023
Malicious code in fca-dongdz2006 (npm)
- Sep 19, 2023
Malware in simple-team-api
1 compromised version
- Sep 19, 2023
Malware in fca-dongdz2006
1 compromised version
- Sep 19, 2023
Malware in paypal-validators
1 compromised version
- Sep 19, 2023
Malicious code in @klapp-settlement/store (npm)
- Sep 19, 2023
Malware in @klapp-settlement/store
1 compromised version
- Sep 19, 2023
Malicious code in synth-fhr-db (npm)
- Sep 19, 2023
Malicious code in jake-horizon (npm)
16 compromised versions
- Sep 19, 2023
Malicious code in beta-fhr (npm)
3 compromised versions
- Sep 19, 2023
Malware in beta-fhr
1 compromised version
- Sep 19, 2023
Malware in jake-horizon
1 compromised version
- Sep 19, 2023
Malware in synth-fhr-db
1 compromised version
- Sep 19, 2023
Malicious code in fca-jordan (npm)
- Sep 19, 2023
Malicious code in fca-chana (npm)
- Sep 19, 2023
Malicious code in fb-chat-api-temp (npm)
- Sep 19, 2023
Malicious code in chand-trick (npm)
- Sep 19, 2023
Malware in chand-trick
1 compromised version
- Sep 19, 2023
Malware in fca-jordan
1 compromised version
- Sep 19, 2023
Malware in fb-chat-api-temp
1 compromised version
- Sep 19, 2023
Malware in fca-chana
1 compromised version
- Sep 19, 2023
Malicious code in fca-cat-api (npm)
- Sep 19, 2023
Malicious code in fca-abdulla-api (npm)
- Sep 19, 2023
Malware in fca-abdulla-api
1 compromised version
- Sep 19, 2023
Malware in fca-cat-api
1 compromised version
- Sep 19, 2023
Malicious code in @cat-abdulla/fca-abdulla-api (npm)
- Sep 19, 2023
Malware in @cat-abdulla/fca-abdulla-api
1 compromised version
Page 6817 of 7,305