Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Oct 5, 2022
Malware in helm-secrets-sops-driver
1 compromised version
- Oct 5, 2022
Malware in darshanbro
1 compromised version
- Oct 5, 2022
Malware in vinayakgadha
1 compromised version
- Oct 5, 2022
Malware in win32ipc
1 compromised version
- Oct 5, 2022
Malicious code in discord-external (npm)
- Oct 5, 2022
Malware in discord-external
1 compromised version
- Oct 4, 2022
Malicious code in tds-publish (npm)
- Oct 4, 2022
Malware in tds-publish
1 compromised version
- Oct 4, 2022
Malicious code in ibiza-universe (npm)
- Oct 4, 2022
Malware in ibiza-universe
1 compromised version
- Oct 4, 2022
Malicious code in webcm-dev (npm)
- Oct 4, 2022
Malware in webcm-dev
1 compromised version
- Sep 29, 2022
Malicious code in dup-glob (npm)
- Sep 29, 2022
Malware in dup-glob
1 compromised version
- Sep 29, 2022
Malicious code in log-status (npm)
- Sep 29, 2022
Malware in log-status
1 compromised version
- Sep 29, 2022
Malicious code in iconbaru (npm)
- Sep 29, 2022
Malware in iconbaru
1 compromised version
- Sep 28, 2022
Malicious code in gramin-npm (npm)
- Sep 28, 2022
Malware in gramin-npm
1 compromised version
- Sep 28, 2022
Malicious code in @aszxc/npmexp (npm)
- Sep 28, 2022
Malware in @aszxc/npmexp
1 compromised version
- Sep 28, 2022
Malicious code in namatnawbyteweb6 (npm)
- Sep 28, 2022
Malware in namatnawbyteweb6
1 compromised version
- Sep 27, 2022
Malicious code in polkadot-staking-dashboard (npm)
- Sep 27, 2022
Malicious code in flashloan (npm)
- Sep 27, 2022
Malware in polkadot-staking-dashboard
1 compromised version
- Sep 27, 2022
Malware in flashloan
1 compromised version
- Sep 27, 2022
Malicious code in sfos-ui (npm)
- Sep 27, 2022
Malware in sfos-ui
1 compromised version
- Sep 27, 2022
Malicious code in hsqyyds (npm)
- Sep 27, 2022
Malware in hsqyyds
1 compromised version
- Sep 27, 2022
Malicious code in myapp-by-7h3n00b (npm)
- Sep 27, 2022
Malicious code in 7h3n00b2 (npm)
- Sep 27, 2022
Malicious code in hyperwallet-node (npm)
- Sep 27, 2022
Malware in 7h3n00b2
1 compromised version
- Sep 27, 2022
Malware in hyperwallet-node
1 compromised version
- Sep 27, 2022
Malware in myapp-by-7h3n00b
1 compromised version
- Sep 27, 2022
Malicious code in kakau-infos (npm)
- Sep 27, 2022
Malicious code in informationdc (npm)
- Sep 27, 2022
Malicious code in fetch-safer (npm)
- Sep 27, 2022
Malicious code in console_colored (npm)
- Sep 27, 2022
Malware in console_colored
1 compromised version
- Sep 27, 2022
Malware in fetch-safer
1 compromised version
- Sep 27, 2022
Malware in kakau-infos
1 compromised version
- Sep 27, 2022
Malware in informationdc
1 compromised version
- Sep 26, 2022
Malicious code in alias-for-vue3 (npm)
- Sep 26, 2022
Malicious code in trading-tips (npm)
- Sep 26, 2022
Malicious code in 5to6-exports (npm)
- Sep 26, 2022
Malicious code in eslint-config-keep (npm)
Page 7004 of 7,293