Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Sep 13, 2022
Malicious code in pkg_with_bin (npm)
- Sep 13, 2022
Malicious code in hoisting-peer-check-child (npm)
- Sep 13, 2022
Malicious code in has-bin-entries (npm)
- Sep 13, 2022
Malicious code in ganache-cli-coverage (npm)
- Sep 13, 2022
Malicious code in builtin-pages-lib (npm)
- Sep 13, 2022
Malicious code in beaker-virtual-fs (npm)
- Sep 13, 2022
Malware in has-bin-entries
1 compromised version
- Sep 13, 2022
Malware in hoisting-peer-check-child
1 compromised version
- Sep 13, 2022
Malware in ganache-cli-coverage
1 compromised version
- Sep 13, 2022
Malware in pkg_with_bin
1 compromised version
- Sep 13, 2022
Malware in beaker-virtual-fs
1 compromised version
- Sep 13, 2022
Malware in builtin-pages-lib
1 compromised version
- Sep 12, 2022
Malicious code in troy-common (npm)
- Sep 12, 2022
Malware in troy-common
1 compromised version
- Sep 12, 2022
Malicious code in @himmuhimmu797/lock (npm)
- Sep 12, 2022
Malware in @himmuhimmu797/lock
1 compromised version
- Sep 12, 2022
Malicious code in top-module (npm)
- Sep 12, 2022
Malicious code in root-b (npm)
- Sep 12, 2022
Malicious code in node_resolve_index_4 (npm)
- Sep 12, 2022
Malicious code in node_resolve_index (npm)
- Sep 12, 2022
Malicious code in faust-nx-cli (npm)
- Sep 12, 2022
Malicious code in example-yarn-package (npm)
- Sep 12, 2022
Malicious code in e2e-test-repo (npm)
- Sep 12, 2022
Malicious code in dep-loop-exit (npm)
- Sep 12, 2022
Malicious code in dep-incompatible (npm)
- Sep 12, 2022
Malware in dep-loop-exit
1 compromised version
- Sep 12, 2022
Malware in root-b
1 compromised version
- Sep 12, 2022
Malware in faust-nx-cli
1 compromised version
- Sep 12, 2022
Malware in dep-incompatible
1 compromised version
- Sep 12, 2022
Malware in top-module
1 compromised version
- Sep 12, 2022
Malware in node_resolve_index_4
1 compromised version
- Sep 12, 2022
Malware in e2e-test-repo
1 compromised version
- Sep 12, 2022
Malware in example-yarn-package
1 compromised version
- Sep 12, 2022
Malware in node_resolve_index
1 compromised version
- Sep 9, 2022
Malicious code in internallib_v216 (npm)
- Sep 9, 2022
Malware in internallib_v216
1 compromised version
- Sep 9, 2022
Malicious code in internallib_v742 (npm)
- Sep 9, 2022
Malicious code in internallib_v229 (npm)
- Sep 9, 2022
Malware in internallib_v229
1 compromised version
- Sep 9, 2022
Malware in internallib_v742
1 compromised version
- Sep 8, 2022
Malicious code in selfbot-developer (npm)
- Sep 8, 2022
Malware in selfbot-developer
1 compromised version
- Sep 8, 2022
Malicious code in rhyselsmore-poc (npm)
- Sep 8, 2022
Malware in rhyselsmore-poc
1 compromised version
- Sep 8, 2022
Malicious code in rhyselsmore-research-security (npm)
- Sep 8, 2022
Malware in rhyselsmore-research-security
1 compromised version
- Sep 8, 2022
Malicious code in @anemone95/evil (npm)
- Sep 8, 2022
Malicious code in useevil (npm)
- Sep 8, 2022
Malicious code in obfuscation-detector2 (npm)
- Sep 8, 2022
Malware in @anemone95/evil
1 compromised version
Page 7009 of 7,293