Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Sep 21, 2022
Malicious code in testhawaii123 (npm)
- Sep 21, 2022
Malicious code in testdir12345 (npm)
- Sep 21, 2022
Malicious code in openswift (npm)
- Sep 21, 2022
Malicious code in hawaii-webchat (npm)
- Sep 21, 2022
Malware in testdir12345
1 compromised version
- Sep 21, 2022
Malware in hawaii-webchat
1 compromised version
- Sep 21, 2022
Malware in openswift
1 compromised version
- Sep 21, 2022
Malware in testhawaii123
1 compromised version
- Sep 19, 2022
Malicious code in ca-bucky-client (npm)
- Sep 19, 2022
Malware in ca-bucky-client
1 compromised version
- Sep 19, 2022
Malicious code in react18 (npm)
- Sep 19, 2022
Malicious code in ion-schema-sandbox (npm)
- Sep 19, 2022
Malware in ion-schema-sandbox
1 compromised version
- Sep 19, 2022
Malware in react18
1 compromised version
- Sep 19, 2022
Malicious code in test-hach (npm)
- Sep 19, 2022
Malware in test-hach
1 compromised version
- Sep 18, 2022
Malicious code in jaylen-db (npm)
- Sep 18, 2022
Malware in jaylen-db
1 compromised version
- Sep 18, 2022
Malicious code in zezedb (npm)
- Sep 18, 2022
Malware in zezedb
1 compromised version
- Sep 16, 2022
Malicious code in burningred (npm)
- Sep 16, 2022
Malware in burningred
1 compromised version
- Sep 15, 2022
Malicious code in dc-test-jq (npm)
- Sep 15, 2022
Malicious code in dc-main (npm)
- Sep 15, 2022
Malware in dc-test-jq
1 compromised version
- Sep 15, 2022
Malware in dc-main
1 compromised version
- Sep 14, 2022
Malicious code in trin-glob (npm)
5 compromised versions
- Sep 14, 2022
Malware in trin-glob
1 compromised version
- Sep 14, 2022
Malicious code in orangepay-ecommerce-sdk (npm)
- Sep 14, 2022
Malware in orangepay-ecommerce-sdk
1 compromised version
- Sep 14, 2022
Malicious code in @arkadium/eagle-user-client (npm)
2 compromised versions
- Sep 14, 2022
Malware in @arkadium/eagle-user-client
1 compromised version
- Sep 14, 2022
Malicious code in sso-ebay (npm)
- Sep 14, 2022
Malicious code in service-client-ebay (npm)
- Sep 14, 2022
Malicious code in security-ebay (npm)
- Sep 14, 2022
Malicious code in monitor-inc (npm)
- Sep 14, 2022
Malicious code in metrics-ebay (npm)
- Sep 14, 2022
Malicious code in logging-inc (npm)
- Sep 14, 2022
Malicious code in ebayui-ads (npm)
- Sep 14, 2022
Malicious code in commons-ebay (npm)
- Sep 14, 2022
Malware in commons-ebay
1 compromised version
- Sep 14, 2022
Malware in ebayui-ads
1 compromised version
- Sep 14, 2022
Malware in metrics-ebay
1 compromised version
- Sep 14, 2022
Malware in monitor-inc
1 compromised version
- Sep 14, 2022
Malware in service-client-ebay
1 compromised version
- Sep 14, 2022
Malware in security-ebay
1 compromised version
- Sep 14, 2022
Malware in logging-inc
1 compromised version
- Sep 14, 2022
Malware in sso-ebay
1 compromised version
- Sep 14, 2022
Malicious code in optimizer-plugin-inc (npm)
- Sep 14, 2022
Malicious code in navigator-fingerprint-front (npm)
Page 7006 of 7,293