Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Nov 7, 2022
Malware in syntax_manager
1 compromised version
- Nov 7, 2022
Malware in theme_manager_base
1 compromised version
- Nov 7, 2022
Malware in jquery_ui_checkbowwx
1 compromised version
- Nov 7, 2022
Malware in addon-kit
1 compromised version
- Nov 7, 2022
Malware in hemoabsihh12
1 compromised version
- Nov 7, 2022
Malware in jquery_ui_checkbox
1 compromised version
- Nov 7, 2022
Malicious code in xv_chrome (npm)
- Nov 7, 2022
Malware in xv_chrome
1 compromised version
- Nov 7, 2022
Malicious code in mantis-ui (npm)
- Nov 7, 2022
Malware in mantis-ui
1 compromised version
- Nov 3, 2022
Malicious code in esperamier (npm)
- Nov 3, 2022
Malicious code in bc-demo (npm)
- Nov 3, 2022
Malware in esperamier
1 compromised version
- Nov 3, 2022
Malware in bc-demo
1 compromised version
- Oct 31, 2022
Malicious code in @uniswapv2/mempool (npm)
- Oct 31, 2022
Malware in @uniswapv2/mempool
1 compromised version
- Oct 31, 2022
Malicious code in richsite (npm)
- Oct 31, 2022
Malware in richsite
1 compromised version
- Oct 31, 2022
Malicious code in we-lib-login-tgp (npm)
- Oct 31, 2022
Malware in we-lib-login-tgp
1 compromised version
- Oct 31, 2022
Malicious code in waffles2-presentation (npm)
- Oct 31, 2022
Malicious code in waffles-next-doc-site (npm)
- Oct 31, 2022
Malicious code in rdocumentation-workers (npm)
- Oct 31, 2022
Malicious code in rdocumentation-app (npm)
- Oct 31, 2022
Malicious code in codemirror-6-getting-started (npm)
- Oct 31, 2022
Malicious code in ast-viewer (npm)
- Oct 31, 2022
Malware in codemirror-6-getting-started
1 compromised version
- Oct 31, 2022
Malware in waffles-next-doc-site
1 compromised version
- Oct 31, 2022
Malware in ast-viewer
1 compromised version
- Oct 31, 2022
Malware in rdocumentation-app
1 compromised version
- Oct 31, 2022
Malware in rdocumentation-workers
1 compromised version
- Oct 31, 2022
Malware in waffles2-presentation
1 compromised version
- Oct 31, 2022
Malicious code in reviewstack (npm)
- Oct 31, 2022
Malware in reviewstack
1 compromised version
- Oct 31, 2022
Malicious code in colorajs (npm)
- Oct 31, 2022
Malware in colorajs
1 compromised version
- Oct 31, 2022
Malicious code in hardhat-modern (npm)
- Oct 31, 2022
Malicious code in hardhat-config (npm)
- Oct 31, 2022
Malware in hardhat-config
1 compromised version
- Oct 31, 2022
Malware in hardhat-modern
1 compromised version
- Oct 28, 2022
Malicious code in mailchimp-marketing (npm)
- Oct 28, 2022
Malware in mailchimp-marketing
1 compromised version
- Oct 28, 2022
Malicious code in mailchimp_transactional (npm)
- Oct 28, 2022
Malware in mailchimp_transactional
1 compromised version
- Oct 27, 2022
Malicious code in web3-update (npm)
- Oct 27, 2022
Malicious code in modern-hardhat (npm)
- Oct 27, 2022
Malware in web3-update
1 compromised version
- Oct 27, 2022
Malware in modern-hardhat
1 compromised version
- Oct 26, 2022
Malicious code in safe-nonce-7218 (npm)
- Oct 26, 2022
Malicious code in safe-nonce-6218 (npm)
Page 7000 of 7,293