Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Aug 19, 2022
Malware in isextrt
1 compromised version
- Aug 19, 2022
Malware in lorash3fset
1 compromised version
- Aug 19, 2022
Malware in koacompocse
1 compromised version
- Aug 19, 2022
Malware in lodasqhcamelcase
1 compromised version
- Aug 19, 2022
Malware in mimetyps
1 compromised version
- Aug 19, 2022
Malware in jja4de
1 compromised version
- Aug 19, 2022
Malware in levl
1 compromised version
- Aug 19, 2022
Malware in metalmi
1 compromised version
- Aug 19, 2022
Malware in lrucacee
1 compromised version
- Aug 19, 2022
Malware in m5d
1 compromised version
- Aug 19, 2022
Malware in lodashisemuty
1 compromised version
- Aug 19, 2022
Malware in markdowvnit
1 compromised version
- Aug 19, 2022
Malware in jestreolv
1 compromised version
- Aug 19, 2022
Malware in lodashisobjct
1 compromised version
- Aug 19, 2022
Malware in lokdashtemplate
1 compromised version
- Aug 19, 2022
Malware in lodashassig
1 compromised version
- Aug 19, 2022
Malware in mat6rialui
1 compromised version
- Aug 19, 2022
Malware in karmachromelauncer
1 compromised version
- Aug 19, 2022
Malware in lodaschisstring
1 compromised version
- Aug 19, 2022
Malware in koabodparser
1 compromised version
- Aug 19, 2022
Malware in lementui
1 compromised version
- Aug 19, 2022
Malware in mdfile
1 compromised version
- Aug 19, 2022
Malware in isomorphceftch
1 compromised version
- Aug 19, 2022
Malware in kapollolink
1 compromised version
- Aug 19, 2022
Malware in jsase64
1 compromised version
- Aug 19, 2022
Malware in isprgomise
1 compromised version
- Aug 19, 2022
Malware in lessoader
1 compromised version
- Aug 19, 2022
Malware in lodashfroeach
1 compromised version
- Aug 19, 2022
Malicious code in ioderits (npm)
- Aug 19, 2022
Malicious code in inxi (npm)
- Aug 19, 2022
Malicious code in invariqaot (npm)
- Aug 19, 2022
Malicious code in infyl (npm)
- Aug 19, 2022
Malicious code in immutoabilityhelper (npm)
- Aug 19, 2022
Malicious code in imagemu8 (npm)
- Aug 19, 2022
Malicious code in ihghland (npm)
- Aug 19, 2022
Malicious code in ierbase (npm)
- Aug 19, 2022
Malicious code in idejtityobjproxy (npm)
- Aug 19, 2022
Malicious code in hutpproxymiddleware (npm)
- Aug 19, 2022
Malicious code in husy (npm)
- Aug 19, 2022
Malicious code in httrperrors (npm)
- Aug 19, 2022
Malicious code in httpstatuscoxes (npm)
- Aug 19, 2022
Malicious code in httpsrver (npm)
- Aug 19, 2022
Malicious code in httpproxyagnc (npm)
- Aug 19, 2022
Malicious code in httppoy (npm)
- Aug 19, 2022
Malicious code in htmlwebpacplulin (npm)
- Aug 19, 2022
Malicious code in htmlpjader (npm)
- Aug 19, 2022
Malicious code in htmlminifire (npm)
- Aug 19, 2022
Malicious code in htlparsevr2 (npm)
- Aug 19, 2022
Malicious code in hpathexists (npm)
- Aug 19, 2022
Malicious code in hoistnonjreactstatics (npm)
Page 7038 of 7,293