Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,217 total · sorted newest first- Apr 28, 2023
Malicious code in links-3 (npm)
2 compromised versions
- Apr 28, 2023
Malicious code in yc-as-client (PyPI)
1 compromised version
- Apr 28, 2023
Malicious code in @hyperion-util/deferred-value (npm)
1 compromised version
- Apr 28, 2023
Malicious code in @hyperion-util/script-loader (npm)
1 compromised version
- Apr 28, 2023
Malicious code in @hyperion-util/cookies (npm)
1 compromised version
- Apr 28, 2023
Malicious code in bjss-atp-web (npm)
1 compromised version
- Apr 27, 2023
Malicious code in fsevents (npm)
- Apr 27, 2023
Malware in fsevents
1 compromised version
- Apr 27, 2023
Malicious code in roblopython (PyPI)
1 compromised version
- Apr 27, 2023
Malicious code in store-js-sdk (npm)
2 compromised versions
- Apr 27, 2023
Malicious code in parallel-workers (npm)
5 compromised versions
- Apr 27, 2023
Malicious code in redirect-support (npm)
1 compromised version
- Apr 27, 2023
Malicious code in 3a-spawn (npm)
- Apr 27, 2023
Malicious code in 3a-look (npm)
- Apr 27, 2023
Malicious code in algo-svnlook (npm)
- Apr 26, 2023
Malicious code in gtf-error-tracker (npm)
1 compromised version
- Apr 26, 2023
Malicious code in sheer-chat-client (npm)
1 compromised version
- Apr 26, 2023
Malicious code in she-c (npm)
1 compromised version
- Apr 26, 2023
Malicious code in inter-mobile-bridge (npm)
1 compromised version
- Apr 26, 2023
Malicious code in service-etl (PyPI)
1 compromised version
- Apr 26, 2023
Malicious code in taxi-etl (PyPI)
1 compromised version
- Apr 26, 2023
Malicious code in dmp-suite (PyPI)
1 compromised version
- Apr 26, 2023
Malicious code in hpackeyboard-core (npm)
1 compromised version
- Apr 26, 2023
Malicious code in @expressions/excel-functions (npm)
1 compromised version
- Apr 26, 2023
Malicious code in example-package-taxi-etl (PyPI)
1 compromised version
- Apr 26, 2023
Malicious code in react-div-100vh-test (npm)
1 compromised version
- Apr 26, 2023
Malicious code in ssh-compute (npm)
2 compromised versions
- Apr 26, 2023
Malicious code in tzinfo-i18n (RubyGems)
1 compromised version
- Apr 26, 2023
Malicious code in loveslack (npm)
1 compromised version
- Apr 26, 2023
Malicious code in loveapple (npm)
1 compromised version
- Apr 26, 2023
Malicious code in nodejs-encrypt-agent (npm)
4 compromised versions
- Apr 26, 2023
Malicious code in nodejs-cookie-proxy-agent (npm)
6 compromised versions
- Apr 26, 2023
Malware in nodejs-encrypt-agent
1 compromised version
- Apr 26, 2023
Malware in nodejs-cookie-proxy-agent
1 compromised version
- Apr 26, 2023
Malicious code in apnic-ui (npm)
14 compromised versions
- Apr 26, 2023
Malware in apnic-ui
1 compromised version
- Apr 26, 2023
Malicious code in mpc-ap-styles (npm)
4 compromised versions
- Apr 26, 2023
Malicious code in algo-svnspawn (npm)
- Apr 25, 2023
Malicious code in tucan-x (PyPI)
2 compromised versions
- Apr 25, 2023
Malicious code in here-cicd (npm)
- Apr 25, 2023
Malware in here-cicd
1 compromised version
- Apr 25, 2023
Malicious code in nlp-react-native (npm)
- Apr 25, 2023
Malware in nlp-react-native
1 compromised version
- Apr 25, 2023
Malicious code in reality-lens-sdk (npm)
- Apr 25, 2023
Malware in reality-lens-sdk
1 compromised version
- Apr 25, 2023
Malicious code in schema2x (npm)
- Apr 25, 2023
Malware in schema2x
1 compromised version
- Apr 25, 2023
Malicious code in schema2x-annotations (npm)
- Apr 25, 2023
Malware in schema2x-annotations
1 compromised version
- Apr 25, 2023
Malicious code in grunt-heremaps-build (npm)
Page 6859 of 7,305