Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,217 total · sorted newest first- Jul 26, 2023
Malicious code in do_not_install_this_is_a_test_package_norwegianwood (npm)
- Jul 26, 2023
Malicious code in athulkrishnan_test_package (npm)
- Jul 26, 2023
Malware in do_not_install_this_is_a_test_package_norwegianwood
1 compromised version
- Jul 26, 2023
Malware in athulkrishnan_test_package
1 compromised version
- Jul 26, 2023
Malware in akita-docs
1 compromised version
- Jul 26, 2023
Malicious code in dox_assets (npm)
3 compromised versions
- Jul 26, 2023
Malicious code in cloudsplaining (npm)
3 compromised versions
- Jul 26, 2023
Malicious code in akita-docs (npm)
1 compromised version
- Jul 26, 2023
Malicious code in matlab-language-server (npm)
2 compromised versions
- Jul 26, 2023
Malicious code in infobip-rtc-token (npm)
1 compromised version
- Jul 26, 2023
Malware in hui-logger
1 compromised version
- Jul 26, 2023
Malware in hui-sdk
1 compromised version
- Jul 26, 2023
Malicious code in fca-chat-zach (npm)
- Jul 26, 2023
Malware in fca-chat-zach
1 compromised version
- Jul 26, 2023
Malicious code in grizzly_sql_graph_visualization (npm)
1 compromised version
- Jul 26, 2023
Malicious code in tema-cnp (npm)
3 compromised versions
- Jul 26, 2023
Malicious code in cnp_al_corp_front (npm)
3 compromised versions
- Jul 25, 2023
Malicious code in some_internal_package_for_testing (npm)
1 compromised version
- Jul 25, 2023
Malicious code in hui-logger (npm)
1 compromised version
- Jul 25, 2023
Malicious code in hui-micro-app (npm)
1 compromised version
- Jul 25, 2023
Malicious code in wrangler-dev-api-app (npm)
1 compromised version
- Jul 25, 2023
Malicious code in pages-workerjs-app (npm)
2 compromised versions
- Jul 25, 2023
Malicious code in deploy-workers-cloudflare-com (npm)
1 compromised version
- Jul 25, 2023
Malicious code in uitk-react-action-list-item (npm)
2 compromised versions
- Jul 25, 2023
Malicious code in hui-sdk (npm)
1 compromised version
- Jul 25, 2023
Malicious code in hellodependency5 (npm)
1 compromised version
- Jul 25, 2023
Malicious code in hellodependency3 (npm)
3 compromised versions
- Jul 25, 2023
Malicious code in hellodependency4 (npm)
3 compromised versions
- Jul 25, 2023
Malicious code in hellodependency2 (npm)
2 compromised versions
- Jul 25, 2023
Malicious code in @ms-atlas-module/datastudio-datafactory (npm)
1 compromised version
- Jul 25, 2023
Malicious code in @ms-atlas/datastudio (npm)
1 compromised version
- Jul 25, 2023
Malicious code in @ms-atlas/datastudio-diagnostics (npm)
1 compromised version
- Jul 24, 2023
Malicious code in synthetics-recorder (npm)
2 compromised versions
- Jul 24, 2023
Malicious code in solodev-cms (npm)
1 compromised version
- Jul 24, 2023
Malicious code in icoreact (npm)
1 compromised version
- Jul 24, 2023
Malicious code in nwa-uikit-web (npm)
4 compromised versions
- Jul 24, 2023
Malicious code in fca-innova (npm)
- Jul 24, 2023
Malware in fca-innova
1 compromised version
- Jul 24, 2023
Malicious code in expressautomations (npm)
- Jul 24, 2023
Malware in expressautomations
1 compromised version
- Jul 24, 2023
Malicious code in team-atf-2 (npm)
- Jul 24, 2023
Malicious code in chand (npm)
- Jul 24, 2023
Malware in chand
1 compromised version
- Jul 24, 2023
Malware in team-atf-2
1 compromised version
- Jul 24, 2023
Malicious code in shein-bbl (npm)
1 compromised version
- Jul 24, 2023
Withdrawn Advisory: Malware in @mendeley-internal/api
1 compromised version
- Jul 24, 2023
Malicious code in duongkum999 (npm)
- Jul 24, 2023
Malware in duongkum999
1 compromised version
- Jul 24, 2023
Malicious code in fca-dongdz-remake (npm)
- Jul 24, 2023
Malicious code in fca-dong (npm)
Page 6834 of 7,305