Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Oct 26, 2022
Malware in safe-nonce-6218
1 compromised version
- Oct 26, 2022
Malware in safe-nonce-7218
1 compromised version
- Oct 25, 2022
Malicious code in @uniswapv3/mempool (npm)
- Oct 25, 2022
Malicious code in uniswaptokens (npm)
- Oct 25, 2022
Malicious code in etherscantokens (npm)
- Oct 25, 2022
Malware in etherscantokens
1 compromised version
- Oct 25, 2022
Malware in uniswaptokens
1 compromised version
- Oct 25, 2022
Malware in @uniswapv3/mempool
1 compromised version
- Oct 25, 2022
Malicious code in aries-askar-shared (npm)
- Oct 25, 2022
Malware in aries-askar-shared
1 compromised version
- Oct 25, 2022
Malicious code in @paid-cloud/contracts (npm)
- Oct 25, 2022
Malware in @paid-cloud/contracts
1 compromised version
- Oct 24, 2022
Malicious code in tttestsupport-common (npm)
- Oct 24, 2022
Malicious code in s3mock-testsupport-common (npm)
- Oct 24, 2022
Malicious code in pig_13_prod (npm)
- Oct 24, 2022
Malicious code in maven-fluido-skin (npm)
- Oct 24, 2022
Malicious code in maven-compiler-plugin (npm)
- Oct 24, 2022
Malware in pig_13_prod
1 compromised version
- Oct 24, 2022
Malware in tttestsupport-common
1 compromised version
- Oct 24, 2022
Malware in maven-compiler-plugin
1 compromised version
- Oct 24, 2022
Malware in s3mock-testsupport-common
1 compromised version
- Oct 24, 2022
Malware in maven-fluido-skin
1 compromised version
- Oct 24, 2022
Malicious code in anchor-lang (npm)
- Oct 24, 2022
Malicious code in test_1_61 (npm)
- Oct 24, 2022
Malicious code in test_1_60 (npm)
- Oct 24, 2022
Malicious code in test_1_59 (npm)
- Oct 24, 2022
Malicious code in test_1_58 (npm)
- Oct 24, 2022
Malicious code in test_1_57 (npm)
- Oct 24, 2022
Malicious code in spring-boot-devtools (npm)
- Oct 24, 2022
Malicious code in dapp2nix (npm)
- Oct 24, 2022
Malicious code in boost-for-react-native (npm)
- Oct 24, 2022
Malware in boost-for-react-native
1 compromised version
- Oct 24, 2022
Malware in test_1_58
1 compromised version
- Oct 24, 2022
Malware in anchor-lang
1 compromised version
- Oct 24, 2022
Malware in test_1_59
1 compromised version
- Oct 24, 2022
Malware in test_1_60
1 compromised version
- Oct 24, 2022
Malware in dapp2nix
1 compromised version
- Oct 24, 2022
Malware in test_1_61
1 compromised version
- Oct 24, 2022
Malware in test_1_57
1 compromised version
- Oct 24, 2022
Malware in spring-boot-devtools
1 compromised version
- Oct 24, 2022
Malicious code in surveyoptic (npm)
- Oct 24, 2022
Malware in surveyoptic
1 compromised version
- Oct 24, 2022
Malicious code in ui-ace (npm)
- Oct 24, 2022
Malware in ui-ace
1 compromised version
- Oct 24, 2022
Malicious code in aae-stream (npm)
- Oct 24, 2022
Malware in aae-stream
1 compromised version
- Oct 21, 2022
Malicious code in ty-cdn (npm)
- Oct 21, 2022
Malicious code in tazrim (npm)
- Oct 21, 2022
Malware in tazrim
1 compromised version
- Oct 21, 2022
Malware in ty-cdn
1 compromised version
Page 7001 of 7,293