Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,217 total · sorted newest first- Sep 18, 2023
Malware in loudashe
1 compromised version
- Sep 18, 2023
Malware in rodashe
1 compromised version
- Sep 18, 2023
Malware in hardhat-contract-size
1 compromised version
- Sep 18, 2023
Malware in truffle-gas-report
1 compromised version
- Sep 18, 2023
Malware in hardhat-gas-report
1 compromised version
- Sep 18, 2023
Malware in etheres.js
1 compromised version
- Sep 18, 2023
Malware in eterscan-api
1 compromised version
- Sep 18, 2023
Malware in hardhat-gas-tracer
1 compromised version
- Sep 18, 2023
Malware in lodarshe
1 compromised version
- Sep 18, 2023
Malware in hadhat-contract-sizer
1 compromised version
- Sep 18, 2023
Malware in eteres
1 compromised version
- Sep 18, 2023
Malware in developer-scaffold-full-width-wrapper
1 compromised version
- Sep 18, 2023
Malware in centurylink
1 compromised version
- Sep 18, 2023
Malware in walletconnect-website
1 compromised version
- Sep 18, 2023
Malware in subspace-relayer-front-end
1 compromised version
- Sep 18, 2023
Malware in pathkit-local
1 compromised version
- Sep 18, 2023
Malicious code in symbl_ai (npm)
- Sep 18, 2023
Malware in surf-sharekit-frontend
1 compromised version
- Sep 18, 2023
Malware in adidas-data-mesh
1 compromised version
- Sep 18, 2023
Malware in symbl_ai
1 compromised version
- Sep 18, 2023
Malware in inteken-app-client
1 compromised version
- Sep 18, 2023
Malware in producer-journey
1 compromised version
- Sep 18, 2023
Malware in send-orchestrator-event-lambda
1 compromised version
- Sep 18, 2023
Malicious code in test-archive (npm)
33 compromised versions
- Sep 18, 2023
Malware in test-archive
1 compromised version
- Sep 18, 2023
Malicious code in telia-front-react (npm)
2 compromised versions
- Sep 18, 2023
Malicious code in telia-common-component (npm)
2 compromised versions
- Sep 18, 2023
Malware in telia-common-component
1 compromised version
- Sep 18, 2023
Malware in telia-front-react
1 compromised version
- Sep 18, 2023
Malicious code in pyowler (PyPI)
1 compromised version
- Sep 18, 2023
Malicious code in pylioner (PyPI)
- Sep 17, 2023
Malicious code in centurylink (npm)
11 compromised versions
- Sep 17, 2023
Malicious code in @healthbridge-design-system/components (npm)
1 compromised version
- Sep 17, 2023
Malicious code in walletconnect-website (npm)
5 compromised versions
- Sep 17, 2023
Malicious code in subspace-relayer-front-end (npm)
4 compromised versions
- Sep 17, 2023
Malicious code in pystob (PyPI)
- Sep 16, 2023
Malicious code in mfp-test-repo (npm)
1 compromised version
- Sep 16, 2023
Malicious code in mfp-food-diary (npm)
2 compromised versions
- Sep 16, 2023
Malicious code in pathkit-local (npm)
1 compromised version
- Sep 16, 2023
Malicious code in puppeteer-example (npm)
12 compromised versions
- Sep 16, 2023
Malicious code in developer-scaffold-full-width-wrapper (npm)
6 compromised versions
- Sep 16, 2023
Malicious code in producer-journey (npm)
3 compromised versions
- Sep 16, 2023
Malicious code in send-orchestrator-event-lambda (npm)
1 compromised version
- Sep 16, 2023
Malicious code in adidas-data-mesh (npm)
11 compromised versions
- Sep 16, 2023
Malicious code in inteken-app-client (npm)
4 compromised versions
- Sep 16, 2023
Malicious code in surf-sharekit-frontend (npm)
3 compromised versions
- Sep 16, 2023
Malicious code in jerry1319 (npm)
1 compromised version
- Sep 15, 2023
Malicious code in payment-react-component (npm)
1 compromised version
- Sep 15, 2023
Malicious code in paypal-validators (npm)
1 compromised version
- Sep 14, 2023
Malicious code in sharinj-test (npm)
1 compromised version
Page 6819 of 7,305