Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,217 total · sorted newest first- Jul 24, 2023
Malware in fca-dongdz-remake
1 compromised version
- Jul 24, 2023
Malware in fca-dong
1 compromised version
- Jul 21, 2023
Malicious code in @mendeley-internal/api (npm)
4 compromised versions
- Jul 21, 2023
Malicious code in @mendeley-internal/react-ui (npm)
4 compromised versions
- Jul 21, 2023
Malicious code in calfirebof.web (npm)
1 compromised version
- Jul 21, 2023
Malicious code in renxt-host-service (npm)
2 compromised versions
- Jul 20, 2023
Malicious code in policycms (npm)
2 compromised versions
- Jul 20, 2023
Malicious code in puppeteer-kibana (npm)
1 compromised version
- Jul 20, 2023
Malicious code in @metronetinc/react-component-library-next-plugin (npm)
1 compromised version
- Jul 20, 2023
Malicious code in @metronetinc/react-component-library (npm)
2 compromised versions
- Jul 19, 2023
Malicious code in uber-eslint (npm)
1 compromised version
- Jul 19, 2023
Malicious code in @recordedfuture/rf-native (npm)
1 compromised version
- Jul 19, 2023
Malicious code in scbe (npm)
1 compromised version
- Jul 19, 2023
Malicious code in google-apis-androidpublisher_v2 (RubyGems)
1 compromised version
- Jul 18, 2023
Malicious code in @optalp/test-package (npm)
2 compromised versions
- Jul 18, 2023
Malicious code in @hihihehehaha/vgujsonfrankfurtola (npm)
1 compromised version
- Jul 18, 2023
Malicious code in ux-translation-tools (npm)
- Jul 18, 2023
Malicious code in ux-logging-proxy (npm)
- Jul 18, 2023
Malware in ux-logging-proxy
1 compromised version
- Jul 18, 2023
Malware in ux-translation-tools
1 compromised version
- Jul 18, 2023
Malicious code in fca-zera-remaster (npm)
- Jul 18, 2023
Malicious code in fca-horizon-remaster (npm)
- Jul 18, 2023
Malware in fca-horizon-remaster
1 compromised version
- Jul 18, 2023
Malware in fca-zera-remaster
1 compromised version
- Jul 18, 2023
Malicious code in fca-anup-candy (npm)
- Jul 18, 2023
Malware in fca-anup-candy
1 compromised version
- Jul 17, 2023
Malicious code in @paystackhq/stack-ui (npm)
1 compromised version
- Jul 17, 2023
Malicious code in firefly-utilities-helper-ts (npm)
1 compromised version
- Jul 17, 2023
Malware in vuewjs
1 compromised version
- Jul 17, 2023
Malware in ttf-metadata
1 compromised version
- Jul 17, 2023
Malware in tslib-util
1 compromised version
- Jul 17, 2023
Malware in tslib-react
1 compromised version
- Jul 17, 2023
Malware in jpeg-metadata
1 compromised version
- Jul 17, 2023
Malware in elliptic-parser
1 compromised version
- Jul 17, 2023
Malware in elliptic-helper
1 compromised version
- Jul 17, 2023
Malware in chart-tablejs
1 compromised version
- Jul 17, 2023
Malware in sync-https-api
1 compromised version
- Jul 17, 2023
Malware in sync-http-api
1 compromised version
- Jul 17, 2023
Malware in price-record
1 compromised version
- Jul 17, 2023
Malware in price-fetch
1 compromised version
- Jul 17, 2023
Malware in eth-api-node
1 compromised version
- Jul 17, 2023
Malware in vue-audit
1 compromised version
- Jul 17, 2023
Malware in ejs-audit
1 compromised version
- Jul 17, 2023
Malware in snykaudit-helper
1 compromised version
- Jul 17, 2023
Malware in couchcache-audit
1 compromised version
- Jul 17, 2023
Malware in cache-vue
1 compromised version
- Jul 17, 2023
Malware in cache-react
1 compromised version
- Jul 17, 2023
Malware in btc-web3
1 compromised version
- Jul 17, 2023
Malware in other-web3
1 compromised version
- Jul 17, 2023
Malicious code in systemd-daemon (RubyGems)
1 compromised version
Page 6835 of 7,305