Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Oct 19, 2022
Malicious code in @nexthink/arm-claims-library (npm)
- Oct 19, 2022
Malicious code in @nexthink/apollo-widgets (npm)
- Oct 19, 2022
Malicious code in @nexthink/apollo-tokens (npm)
- Oct 19, 2022
Malware in @nexthink/apollo-tokens
1 compromised version
- Oct 19, 2022
Malware in @nexthink/arm-claims-library
1 compromised version
- Oct 19, 2022
Malware in @nexthink/apollo-widgets
1 compromised version
- Oct 19, 2022
Malicious code in reactive-cashflow (npm)
- Oct 19, 2022
Malware in reactive-cashflow
1 compromised version
- Oct 17, 2022
Malicious code in trin-axios (npm)
- Oct 17, 2022
Malware in trin-axios
1 compromised version
- Oct 12, 2022
Malicious code in discord.js13-selfbot (npm)
- Oct 12, 2022
Malware in discord.js13-selfbot
1 compromised version
- Oct 11, 2022
Malicious code in path-core (npm)
- Oct 11, 2022
Malware in path-core
1 compromised version
- Oct 10, 2022
Malicious code in 4ff-lib-foundation (npm)
- Oct 10, 2022
Malware in 4ff-lib-foundation
1 compromised version
- Oct 7, 2022
Malicious code in wasm-ion-schema-test (npm)
- Oct 7, 2022
Malware in wasm-ion-schema-test
1 compromised version
- Oct 7, 2022
Malicious code in bmt-web-common (npm)
- Oct 7, 2022
Malware in bmt-web-common
1 compromised version
- Oct 5, 2022
Malicious code in iconape (npm)
- Oct 5, 2022
Malware in iconape
1 compromised version
- Oct 5, 2022
Malicious code in amitbhai (npm)
- Oct 5, 2022
Malicious code in win32ipc (npm)
- Oct 5, 2022
Malicious code in vinayakgadha (npm)
- Oct 5, 2022
Malicious code in taniyadidipro (npm)
- Oct 5, 2022
Malicious code in ktst (npm)
- Oct 5, 2022
Malicious code in helm-secrets-sops-driver (npm)
- Oct 5, 2022
Malicious code in helm-harness (npm)
- Oct 5, 2022
Malicious code in harness-helm-plugin (npm)
- Oct 5, 2022
Malicious code in graphql-ms (npm)
- Oct 5, 2022
Malicious code in example-jenkins (npm)
- Oct 5, 2022
Malicious code in example-gke-workload-identity-app (npm)
- Oct 5, 2022
Malicious code in evernote-sdk-sample-node (npm)
- Oct 5, 2022
Malicious code in dexclient (npm)
- Oct 5, 2022
Malicious code in dcrdata (npm)
- Oct 5, 2022
Malicious code in darshanno1 (npm)
- Oct 5, 2022
Malicious code in darshanbro (npm)
- Oct 5, 2022
Malware in taniyadidipro
1 compromised version
- Oct 5, 2022
Malware in dcrdata
1 compromised version
- Oct 5, 2022
Malware in example-jenkins
1 compromised version
- Oct 5, 2022
Malware in ktst
1 compromised version
- Oct 5, 2022
Malware in harness-helm-plugin
1 compromised version
- Oct 5, 2022
Malware in dexclient
1 compromised version
- Oct 5, 2022
Malware in evernote-sdk-sample-node
1 compromised version
- Oct 5, 2022
Malware in example-gke-workload-identity-app
1 compromised version
- Oct 5, 2022
Malware in darshanno1
1 compromised version
- Oct 5, 2022
Malware in graphql-ms
1 compromised version
- Oct 5, 2022
Malware in amitbhai
1 compromised version
- Oct 5, 2022
Malware in helm-harness
1 compromised version
Page 7003 of 7,293