Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,786 total · sorted newest first- Jan 10, 2023
Malware in cu-dashboard-components
1 compromised version
- Jan 10, 2023
Malware in evolve-runtime
1 compromised version
- Jan 10, 2023
Malware in rdi-ui
1 compromised version
- Jan 10, 2023
Malicious code in si-mfes-library (npm)
- Jan 10, 2023
Malicious code in shared-gatsby-components (npm)
- Jan 10, 2023
Malicious code in portal-numbers (npm)
- Jan 10, 2023
Malicious code in maw-fetch (npm)
- Jan 10, 2023
Malicious code in latitude-analytics (npm)
- Jan 10, 2023
Malicious code in hsbc-pb-sdk (npm)
- Jan 10, 2023
Malicious code in generic-ui-components (npm)
- Jan 10, 2023
Malicious code in fi-connect (npm)
- Jan 10, 2023
Malicious code in chrome-extension-message-relay (npm)
- Jan 10, 2023
Malicious code in canopy-common-fo (npm)
- Jan 10, 2023
Malicious code in bsd-ui-utils (npm)
- Jan 10, 2023
Malware in si-mfes-library
1 compromised version
- Jan 10, 2023
Malware in shared-gatsby-components
1 compromised version
- Jan 10, 2023
Malware in latitude-analytics
1 compromised version
- Jan 10, 2023
Malware in generic-ui-components
1 compromised version
- Jan 10, 2023
Malware in hsbc-pb-sdk
1 compromised version
- Jan 10, 2023
Malware in chrome-extension-message-relay
1 compromised version
- Jan 10, 2023
Malware in bsd-ui-utils
1 compromised version
- Jan 10, 2023
Malware in fi-connect
1 compromised version
- Jan 10, 2023
Malware in portal-numbers
1 compromised version
- Jan 10, 2023
Malware in maw-fetch
1 compromised version
- Jan 10, 2023
Malware in canopy-common-fo
1 compromised version
- Jan 9, 2023
Malicious code in @playgami/portal-webpack (npm)
- Jan 9, 2023
Malicious code in @playgami/portal-logs (npm)
- Jan 9, 2023
Malicious code in @playgami/portal-dynamic-copy (npm)
- Jan 9, 2023
Malicious code in @playgami/portal-design-icons (npm)
- Jan 9, 2023
Malicious code in @playgami/eslint-config-portal-typescript (npm)
- Jan 9, 2023
Malicious code in @playgami/eslint-config-portal-react (npm)
- Jan 9, 2023
Malicious code in @playgami/eslint-config-portal-base (npm)
- Jan 9, 2023
Malware in @playgami/portal-design-icons
1 compromised version
- Jan 9, 2023
Malware in @playgami/eslint-config-portal-react
1 compromised version
- Jan 9, 2023
Malware in @playgami/portal-webpack
1 compromised version
- Jan 9, 2023
Malware in @playgami/eslint-config-portal-base
1 compromised version
- Jan 9, 2023
Malware in @playgami/portal-logs
1 compromised version
- Jan 9, 2023
Malware in @playgami/portal-dynamic-copy
1 compromised version
- Jan 9, 2023
Malware in @playgami/eslint-config-portal-typescript
1 compromised version
- Jan 9, 2023
Malicious code in donuts.node-remote (npm)
- Jan 9, 2023
Malicious code in central-ui-component (npm)
- Jan 9, 2023
Malware in donuts.node-remote
1 compromised version
- Jan 9, 2023
Malware in central-ui-component
1 compromised version
- Jan 9, 2023
Malicious code in market-apps-list (npm)
- Jan 9, 2023
Malware in market-apps-list
1 compromised version
- Jan 9, 2023
Malicious code in test-guro (npm)
- Jan 9, 2023
Malware in test-guro
1 compromised version
- Jan 6, 2023
Malicious code in chokidar-next (npm)
- Jan 6, 2023
Malware in chokidar-next
1 compromised version
- Jan 1, 2023
Malicious code in fredli (PyPI)
1 compromised version
Page 6998 of 7,296