Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Sep 26, 2022
Malicious code in apl-client (npm)
- Sep 26, 2022
Malware in 5to6-exports
1 compromised version
- Sep 26, 2022
Malware in eslint-config-keep
1 compromised version
- Sep 26, 2022
Malware in apl-client
1 compromised version
- Sep 26, 2022
Malware in alias-for-vue3
1 compromised version
- Sep 26, 2022
Malware in trading-tips
1 compromised version
- Sep 26, 2022
Malicious code in rn-amazon-payment-service (npm)
- Sep 26, 2022
Malicious code in flipper-plugin-core (npm)
- Sep 26, 2022
Malicious code in com.meta.xr.sdk.empty (npm)
- Sep 26, 2022
Malicious code in com.meta.quest.sdk.empty (npm)
- Sep 26, 2022
Malware in com.meta.quest.sdk.empty
1 compromised version
- Sep 26, 2022
Malware in rn-amazon-payment-service
1 compromised version
- Sep 26, 2022
Malware in com.meta.xr.sdk.empty
1 compromised version
- Sep 26, 2022
Malware in flipper-plugin-core
1 compromised version
- Sep 26, 2022
Malicious code in @trimoz/trimoz-vue-error-handling (npm)
- Sep 26, 2022
Malicious code in @trimoz/trimoz-api-wrapper (npm)
- Sep 26, 2022
Malware in @trimoz/trimoz-api-wrapper
1 compromised version
- Sep 26, 2022
Malware in @trimoz/trimoz-vue-error-handling
1 compromised version
- Sep 26, 2022
Malicious code in sn-par-select (npm)
- Sep 26, 2022
Malware in sn-par-select
1 compromised version
- Sep 23, 2022
Malicious code in @dydxprotocol/solo (npm)
- Sep 23, 2022
Malware in @dydxprotocol/solo
1 compromised version
- Sep 23, 2022
Malicious code in @dydxprotocol/perpetual (npm)
- Sep 23, 2022
Malware in @dydxprotocol/perpetual
1 compromised version
- Sep 23, 2022
Malicious code in ctct-theme (npm)
- Sep 23, 2022
Malware in ctct-theme
1 compromised version
- Sep 22, 2022
Malicious code in material-tailwindcss (npm)
7 compromised versions
- Sep 22, 2022
Malware in material-tailwindcss
1 compromised version
- Sep 21, 2022
Malicious code in luapkg (npm)
- Sep 21, 2022
Malicious code in luajit-stdlib (npm)
- Sep 21, 2022
Malicious code in luajit-build (npm)
- Sep 21, 2022
Malware in luajit-stdlib
1 compromised version
- Sep 21, 2022
Malware in luajit-build
1 compromised version
- Sep 21, 2022
Malware in luapkg
1 compromised version
- Sep 21, 2022
Malicious code in ing-ges6-mfe-utils (npm)
- Sep 21, 2022
Malware in ing-ges6-mfe-utils
1 compromised version
- Sep 21, 2022
Malicious code in selfbots-discord (npm)
- Sep 21, 2022
Malicious code in discord-self-user-bot (npm)
- Sep 21, 2022
Malicious code in discord-canvases (npm)
- Sep 21, 2022
Malware in selfbots-discord
1 compromised version
- Sep 21, 2022
Malware in discord-canvases
1 compromised version
- Sep 21, 2022
Malware in discord-self-user-bot
1 compromised version
- Sep 21, 2022
Malicious code in httsper (npm)
- Sep 21, 2022
Malicious code in discordjs-self-11 (npm)
- Sep 21, 2022
Malicious code in buffer_replacer (npm)
- Sep 21, 2022
Malicious code in bifer (npm)
- Sep 21, 2022
Malware in httsper
1 compromised version
- Sep 21, 2022
Malware in discordjs-self-11
1 compromised version
- Sep 21, 2022
Malware in buffer_replacer
1 compromised version
- Sep 21, 2022
Malware in bifer
1 compromised version
Page 7005 of 7,293