Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,217 total · sorted newest first- Aug 14, 2023
Malicious code in progress-player (npm)
- Aug 14, 2023
Malicious code in pingan-vue-floating (npm)
1 compromised version
- Aug 14, 2023
Malicious code in cloud-room-video (npm)
- Aug 14, 2023
Malware in cloud-room-video
1 compromised version
- Aug 14, 2023
Malware in srm-front-util
1 compromised version
- Aug 14, 2023
Malware in ynf-core-renderer
1 compromised version
- Aug 14, 2023
Malware in ynf-dx-scripts
1 compromised version
- Aug 14, 2023
Malware in ynf-core-loader
1 compromised version
- Aug 14, 2023
Malware in progress-player
1 compromised version
- Aug 14, 2023
Malware in pingan-vue-floating
1 compromised version
- Aug 14, 2023
Malware in ynf-dx-webpack-plugins
1 compromised version
- Aug 14, 2023
Malware in hsqwe
1 compromised version
- Aug 13, 2023
Malicious code in syns-knox-xss-allwhere (PyPI)
1 compromised version
- Aug 13, 2023
Malicious code in express-opentelemetry (npm)
1 compromised version
- Aug 13, 2023
Malicious code in blockly-mirror-demo (npm)
1 compromised version
- Aug 13, 2023
Malicious code in zustand-rc.1 (npm)
1 compromised version
- Aug 12, 2023
Malicious code in bobikssf (PyPI)
1 compromised version
- Aug 11, 2023
Malicious code in python-cos-sdk-v5 (PyPI)
- Aug 11, 2023
Malicious code in hsqwe (npm)
1 compromised version
- Aug 11, 2023
Malicious code in python-aliyun-sdk-core (PyPI)
- Aug 11, 2023
Malicious code in horaw (npm)
- Aug 11, 2023
Malware in horaw
1 compromised version
- Aug 11, 2023
Malicious code in @ratecenter/shared (npm)
- Aug 11, 2023
Malware in @ratecenter/shared
1 compromised version
- Aug 11, 2023
Malicious code in fiji-core-pal (npm)
2 compromised versions
- Aug 11, 2023
Malware in fiji-core-pal
1 compromised version
- Aug 10, 2023
Malicious code in eslint-plugin-ironfish (npm)
3 compromised versions
- Aug 10, 2023
Malicious code in puppet-module-posix-system-r3.2 (RubyGems)
1 compromised version
- Aug 10, 2023
Malicious code in notsogood (PyPI)
1 compromised version
- Aug 10, 2023
Malicious code in python-aliyun-sdk-ecs (PyPI)
- Aug 10, 2023
Malicious code in react-dropzone-legacy (npm)
1 compromised version
- Aug 10, 2023
Malicious code in exp-core-style (npm)
1 compromised version
- Aug 10, 2023
Malware in exp-core-style
1 compromised version
- Aug 10, 2023
Malware in react-dropzone-legacy
1 compromised version
- Aug 10, 2023
Malicious code in fca-jordan-amiir (npm)
- Aug 10, 2023
Malware in fca-jordan-amiir
1 compromised version
- Aug 10, 2023
Malicious code in tra-arifvauchat-api (npm)
- Aug 10, 2023
Malicious code in tra-arifchat-api (npm)
- Aug 10, 2023
Malware in tra-arifvauchat-api
1 compromised version
- Aug 10, 2023
Malware in tra-arifchat-api
1 compromised version
- Aug 10, 2023
Malicious code in react-native-transparent-video (npm)
2 compromised versions
- Aug 10, 2023
Malware in react-native-transparent-video
1 compromised version
- Aug 10, 2023
Malware in noblox.js-ssh
1 compromised version
- Aug 9, 2023
Malicious code in nequi-aws-dynamodb (npm)
2 compromised versions
- Aug 9, 2023
Malicious code in nequi-ci-utils (npm)
1 compromised version
- Aug 9, 2023
Malicious code in eslint-config-onyx-ui (npm)
3 compromised versions
- Aug 9, 2023
Malicious code in jest-cucumber-reporter (npm)
1 compromised version
- Aug 9, 2023
Malicious code in puppet-module-posix-system-r (RubyGems)
1 compromised version
- Aug 9, 2023
Malicious code in eslint-config-ironfish (npm)
4 compromised versions
- Aug 9, 2023
Malware in apple-fallen-package
1 compromised version
Page 6829 of 7,305