Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,217 total · sorted newest first- Apr 12, 2023
Malware in uploadcare-tinymce
1 compromised version
- Apr 12, 2023
Malware in com.example.show-toast
1 compromised version
- Apr 11, 2023
Malicious code in 3commas-api-client (npm)
- Apr 11, 2023
Malware in 3commas-api-client
1 compromised version
- Apr 11, 2023
Malicious code in hsdjhfjsdhfhtest009 (npm)
- Apr 11, 2023
Malicious code in 123rf_contributor_web (npm)
- Apr 11, 2023
Malicious code in 123rf-ui-core (npm)
- Apr 11, 2023
Malware in 123rf-ui-core
1 compromised version
- Apr 11, 2023
Malware in hsdjhfjsdhfhtest009
1 compromised version
- Apr 11, 2023
Malware in 123rf_contributor_web
1 compromised version
- Apr 11, 2023
Malicious code in puik-experimental (npm)
- Apr 11, 2023
Malicious code in puik (npm)
- Apr 11, 2023
Malicious code in @trein/puik-experimental (npm)
- Apr 11, 2023
Malicious code in @trein/puik (npm)
- Apr 11, 2023
Malware in @trein/puik-experimental
1 compromised version
- Apr 11, 2023
Malware in puik
1 compromised version
- Apr 11, 2023
Malware in @trein/puik
1 compromised version
- Apr 11, 2023
Malware in puik-experimental
1 compromised version
- Apr 6, 2023
Malicious code in @bingads-webui-campaign-react/labels-page (npm)
- Apr 6, 2023
Malware in @bingads-webui-campaign-react/labels-page
1 compromised version
- Apr 6, 2023
Malicious code in fabric-components (npm)
- Apr 6, 2023
Malware in fabric-components
1 compromised version
- Apr 6, 2023
Malicious code in mineflayer-patcher (npm)
- Apr 6, 2023
Malicious code in mineflayer-log (npm)
- Apr 6, 2023
Malware in mineflayer-log
1 compromised version
- Apr 6, 2023
Malware in mineflayer-patcher
1 compromised version
- Apr 5, 2023
Malware in attribution-project
1 compromised version
- Apr 4, 2023
Malware in niroborg-npm-com-test
1 compromised version
- Apr 4, 2023
Malware in @pagseguro/pagseguro-utils
1 compromised version
- Apr 4, 2023
Malicious code in node-ainzfb (npm)
- Apr 4, 2023
Malicious code in capfb (npm)
- Apr 4, 2023
Malware in capfb
1 compromised version
- Apr 4, 2023
Malware in node-ainzfb
1 compromised version
- Apr 4, 2023
Malicious code in @zillow-types/constellation (npm)
- Apr 4, 2023
Malware in @zillow-types/constellation
1 compromised version
- Apr 3, 2023
Malicious code in mobilecoin-wallet (npm)
- Apr 3, 2023
Malware in mobilecoin-wallet
1 compromised version
- Apr 3, 2023
Malicious code in mobile-coin-block-explorer (npm)
- Apr 3, 2023
Malware in mobile-coin-block-explorer
1 compromised version
- Apr 3, 2023
Malicious code in omnigodz_testpkg (npm)
- Apr 3, 2023
Malicious code in kemnasa-sp (npm)
- Apr 3, 2023
Malware in omnigodz_testpkg
1 compromised version
- Apr 3, 2023
Malware in kemnasa-sp
1 compromised version
- Apr 3, 2023
Malicious code in marketplace-frontend-client-config (npm)
- Apr 3, 2023
Malware in marketplace-frontend-client-config
1 compromised version
- Apr 3, 2023
Malicious code in gd-login (npm)
1 compromised version
- Apr 3, 2023
Malicious code in gd-config (npm)
3 compromised versions
- Apr 3, 2023
Malicious code in gd-apply (npm)
2 compromised versions
- Apr 3, 2023
Malware in gd-config
1 compromised version
- Apr 3, 2023
Malware in gd-apply
1 compromised version
Page 6862 of 7,305