Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,211 total · sorted newest first- Mar 2, 2023
Malicious code in esqpeprandpaypal (PyPI)
- Mar 2, 2023
Malicious code in tppyrandomed (PyPI)
- Mar 2, 2023
Malicious code in py-hydraurlstudy (PyPI)
- Mar 2, 2023
Malicious code in esqhackedlgtbpip (PyPI)
- Mar 2, 2023
Malicious code in tptoolpywgui (PyPI)
- Mar 2, 2023
Malicious code in selfhackedrandomstudy (PyPI)
- Mar 2, 2023
Malicious code in esqultraultrapong (PyPI)
- Mar 2, 2023
Malicious code in selfvisapostosint (PyPI)
- Mar 1, 2023
Malicious code in hardhat-web3-utility (npm)
- Mar 1, 2023
Malicious code in hardhat-web3-deploy (npm)
- Mar 1, 2023
Malicious code in hardhat-manager (npm)
- Mar 1, 2023
Malware in hardhat-web3-deploy
1 compromised version
- Mar 1, 2023
Malware in hardhat-web3-utility
1 compromised version
- Mar 1, 2023
Malware in hardhat-manager
1 compromised version
- Mar 1, 2023
Malicious code in hardhat-manage (npm)
- Mar 1, 2023
Malware in hardhat-manage
1 compromised version
- Mar 1, 2023
Malicious code in vmw-atk (npm)
- Mar 1, 2023
Malicious code in nokia-smp (npm)
2 compromised versions
- Mar 1, 2023
Malware in vmw-atk
1 compromised version
- Mar 1, 2023
Malware in nokia-smp
1 compromised version
- Feb 28, 2023
Malicious code in tsang-dev (npm)
- Feb 28, 2023
Malware in tsang-dev
1 compromised version
- Feb 28, 2023
Malicious code in fca-sang-remake (npm)
- Feb 28, 2023
Malicious code in fca-sang-dev (npm)
- Feb 28, 2023
Malware in fca-sang-remake
1 compromised version
- Feb 28, 2023
Malware in fca-sang-dev
1 compromised version
- Feb 28, 2023
Malicious code in xman-internal (npm)
- Feb 28, 2023
Malware in xman-internal
1 compromised version
- Feb 27, 2023
Malicious code in py-hackedultratool (PyPI)
- Feb 27, 2023
Malicious code in libccreplacemask (PyPI)
- Feb 27, 2023
Malicious code in selfreplacetoolreplace (PyPI)
- Feb 27, 2023
Malicious code in py-vmpullinfo (PyPI)
- Feb 27, 2023
Malicious code in libguicraftcandy (PyPI)
- Feb 27, 2023
Malicious code in selfstrresuper (PyPI)
- Feb 27, 2023
Malicious code in py-pushpingload (PyPI)
- Feb 27, 2023
Malicious code in libkilledgame (PyPI)
- Feb 27, 2023
Malicious code in selfcvedpep (PyPI)
- Feb 27, 2023
Malicious code in tpreplacekillram (PyPI)
- Feb 27, 2023
Malicious code in py-postvirtualreplace (PyPI)
- Feb 27, 2023
Malicious code in librandomintelgame (PyPI)
- Feb 27, 2023
Malicious code in esqrecpuvm (PyPI)
- Feb 27, 2023
Malicious code in libpiposintmc (PyPI)
- Feb 27, 2023
Malicious code in esqvisastred (PyPI)
- Feb 27, 2023
Malicious code in esqtoolvisaram (PyPI)
- Feb 27, 2023
Malicious code in esqosinthackedstudy (PyPI)
- Feb 27, 2023
Malicious code in tpstudystringpep (PyPI)
- Feb 27, 2023
Malicious code in tppushvmgrand (PyPI)
- Feb 27, 2023
Malicious code in selfcandyhttpnvidia (PyPI)
- Feb 27, 2023
Malicious code in libpullurlcandy (PyPI)
- Feb 27, 2023
Malicious code in libintproofpush (PyPI)
Page 6870 of 7,305