Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Dec 29, 2022
Malicious code in big-design (npm)
- Dec 29, 2022
Malware in big-design
1 compromised version
- Dec 29, 2022
Malware in seaport-gossip
1 compromised version
- Dec 29, 2022
Malware in rippleadminconsole
1 compromised version
- Dec 29, 2022
Malware in sponsor-jobs
1 compromised version
- Dec 29, 2022
Malware in xrpl-org-dev-portal
1 compromised version
- Dec 29, 2022
Malicious code in rum-speedindex (npm)
- Dec 29, 2022
Malware in rum-speedindex
1 compromised version
- Dec 29, 2022
Malicious code in rmgjs-lib (npm)
- Dec 29, 2022
Malicious code in prova-admin (npm)
- Dec 29, 2022
Malicious code in bcashjs-lib (npm)
- Dec 29, 2022
Malware in rmgjs-lib
1 compromised version
- Dec 29, 2022
Malware in bcashjs-lib
1 compromised version
- Dec 29, 2022
Malware in prova-admin
1 compromised version
- Dec 29, 2022
Malicious code in usaa-typography (npm)
- Dec 29, 2022
Malicious code in usaa-form (npm)
- Dec 29, 2022
Malicious code in usaa-datepicker (npm)
- Dec 29, 2022
Malicious code in usaa-colors (npm)
- Dec 29, 2022
Malicious code in ent-cas-form-navigation-buttons (npm)
- Dec 29, 2022
Malware in usaa-datepicker
1 compromised version
- Dec 29, 2022
Malware in usaa-colors
1 compromised version
- Dec 29, 2022
Malware in usaa-typography
1 compromised version
- Dec 29, 2022
Malware in ent-cas-form-navigation-buttons
1 compromised version
- Dec 29, 2022
Malware in usaa-form
1 compromised version
- Dec 21, 2022
Malicious code in niroborg-npm-com-test (npm)
- Dec 21, 2022
Malicious code in niroborg-com-test (npm)
- Dec 19, 2022
Malicious code in experience-template-renderer-react (npm)
- Dec 19, 2022
Malicious code in eg-auth-ui-localization (npm)
- Dec 19, 2022
Malware in experience-template-renderer-react
1 compromised version
- Dec 19, 2022
Malware in eg-auth-ui-localization
1 compromised version
- Dec 19, 2022
Malicious code in arpanrizki-panpan (npm)
- Dec 19, 2022
Malware in arpanrizki-panpan
1 compromised version
- Dec 15, 2022
Malicious code in mrpackage1-npm (npm)
- Dec 15, 2022
Malicious code in gramin-chat1 (npm)
- Dec 15, 2022
Malware in mrpackage1-npm
1 compromised version
- Dec 15, 2022
Malware in gramin-chat1
1 compromised version
- Dec 14, 2022
Malicious code in reload-update-cookies-ahref.com (npm)
- Dec 14, 2022
Malware in reload-update-cookies-ahref.com
1 compromised version
- Dec 13, 2022
Malicious code in test-pls (npm)
- Dec 13, 2022
Malware in test-pls
1 compromised version
- Dec 13, 2022
Malicious code in @proofpoint/fuse-ui (npm)
- Dec 13, 2022
Malware in @proofpoint/fuse-ui
1 compromised version
- Dec 12, 2022
Malicious code in ng-component-library (npm)
- Dec 12, 2022
Malware in ng-component-library
1 compromised version
- Dec 12, 2022
Malicious code in tuikit (npm)
- Dec 12, 2022
Malicious code in tsconfig-package (npm)
- Dec 12, 2022
Malicious code in caliper-publish (npm)
- Dec 12, 2022
Malicious code in aries-bifold (npm)
- Dec 12, 2022
Malware in aries-bifold
1 compromised version
- Dec 12, 2022
Malware in tuikit
1 compromised version
Page 6996 of 7,293