Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,217 total · sorted newest first- Aug 21, 2023
Malware in usaa-page-transition
1 compromised version
- Aug 21, 2023
Malicious code in ent-cas-common-utils (npm)
- Aug 21, 2023
Malware in ent-cas-common-utils
1 compromised version
- Aug 21, 2023
Malicious code in fixed-sidebar-modal (npm)
- Aug 21, 2023
Malware in fixed-sidebar-modal
1 compromised version
- Aug 21, 2023
Malicious code in test-result-logger (npm)
- Aug 21, 2023
Malware in test-result-logger
1 compromised version
- Aug 21, 2023
Malicious code in usaa-qtest-reporter (npm)
- Aug 21, 2023
Malware in usaa-qtest-reporter
1 compromised version
- Aug 21, 2023
Malicious code in usaa-mock-server (npm)
- Aug 21, 2023
Malware in usaa-mock-server
1 compromised version
- Aug 21, 2023
Malicious code in ent-disclosure (npm)
- Aug 21, 2023
Malware in ent-disclosure
1 compromised version
- Aug 21, 2023
Malicious code in personal-profile-utils (npm)
- Aug 21, 2023
Malware in personal-profile-utils
1 compromised version
- Aug 21, 2023
Malicious code in usaa-sass-loader (npm)
- Aug 21, 2023
Malware in usaa-sass-loader
1 compromised version
- Aug 21, 2023
Malicious code in browserslist-config-usaa (npm)
- Aug 21, 2023
Malware in browserslist-config-usaa
1 compromised version
- Aug 21, 2023
Malicious code in vision-chart (npm)
11 compromised versions
- Aug 21, 2023
Malicious code in docs-public-api (npm)
2 compromised versions
- Aug 20, 2023
Malicious code in matomo-screenshot-testing (npm)
1 compromised version
- Aug 20, 2023
Malicious code in securitytxt-worker (npm)
2 compromised versions
- Aug 20, 2023
Malicious code in owncloud-js-dev (npm)
1 compromised version
- Aug 20, 2023
Malicious code in web-dev-for-beginners (npm)
1 compromised version
- Aug 20, 2023
Malicious code in z-foundation (npm)
1 compromised version
- Aug 20, 2023
Malicious code in jscrambler-permission-utils (npm)
1 compromised version
- Aug 20, 2023
Malicious code in wpi-rules-valid-events (npm)
1 compromised version
- Aug 20, 2023
Malicious code in jscrambler-dashboard-components (npm)
1 compromised version
- Aug 20, 2023
Malicious code in code-debug-codes (npm)
1 compromised version
- Aug 20, 2023
Malicious code in jscrambler-cookies (npm)
1 compromised version
- Aug 20, 2023
Malicious code in wpi-xmldom (npm)
1 compromised version
- Aug 20, 2023
Malicious code in sankson (npm)
2 compromised versions
- Aug 20, 2023
Malicious code in hackonex (npm)
2 compromised versions
- Aug 20, 2023
Malicious code in pyminor (PyPI)
1 compromised version
- Aug 19, 2023
Malicious code in kasms (npm)
8 compromised versions
- Aug 19, 2023
Malicious code in github-deployment-action (npm)
2 compromised versions
- Aug 19, 2023
Malicious code in bugsnotfound (npm)
5 compromised versions
- Aug 19, 2023
Malicious code in postman-zendesk-support-theme (npm)
2 compromised versions
- Aug 19, 2023
Malicious code in f0-data-constructor (npm)
2 compromised versions
- Aug 19, 2023
Malicious code in marvelmaniac-devvit-rce (npm)
4 compromised versions
- Aug 19, 2023
Malicious code in gkuis (npm)
1 compromised version
- Aug 17, 2023
Malicious code in inf-build-module (npm)
- Aug 17, 2023
Malware in inf-build-module
1 compromised version
- Aug 17, 2023
Malicious code in stormapps (npm)
1 compromised version
- Aug 17, 2023
Malware in stormapps
1 compromised version
- Aug 17, 2023
Malicious code in pyjoul (PyPI)
1 compromised version
- Aug 16, 2023
Malicious code in python-aliyun-sdk-rds (PyPI)
- Aug 16, 2023
Malicious code in top-gun-maverick (npm)
1 compromised version
- Aug 16, 2023
Malicious code in infima-website (npm)
1 compromised version
Page 6827 of 7,305