Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Aug 17, 2022
Malware in rickyjs
1 compromised version
- Aug 17, 2022
Malware in weather69420
1 compromised version
- Aug 17, 2022
Malicious code in runtime-limiter (npm)
- Aug 17, 2022
Malware in runtime-limiter
1 compromised version
- Aug 17, 2022
Malicious code in trycourier (npm)
- Aug 17, 2022
Malware in trycourier
1 compromised version
- Aug 17, 2022
Malicious code in r3corda (npm)
- Aug 17, 2022
Malware in r3corda
1 compromised version
- Aug 17, 2022
Malicious code in lusha-ui-components-v2 (npm)
- Aug 17, 2022
Malicious code in bi-client-sdk (npm)
- Aug 17, 2022
Malware in bi-client-sdk
1 compromised version
- Aug 17, 2022
Malware in lusha-ui-components-v2
1 compromised version
- Aug 17, 2022
Malicious code in www.coinmarketcap.com (npm)
- Aug 17, 2022
Malware in www.coinmarketcap.com
1 compromised version
- Aug 16, 2022
Malicious code in some-plugin (npm)
- Aug 16, 2022
Malicious code in some-dependency (npm)
- Aug 16, 2022
Malicious code in some-buidler-plugin (npm)
- Aug 16, 2022
Malicious code in perseus-build-settings (npm)
- Aug 16, 2022
Malicious code in papiea-core (npm)
- Aug 16, 2022
Malicious code in optional-dep-wont-be-found (npm)
- Aug 16, 2022
Malicious code in koa-colorful-logger (npm)
- Aug 16, 2022
Malicious code in katt-blueprint-parser (npm)
- Aug 16, 2022
Malware in papiea-core
1 compromised version
- Aug 16, 2022
Malware in some-plugin
1 compromised version
- Aug 16, 2022
Malware in optional-dep-wont-be-found
1 compromised version
- Aug 16, 2022
Malware in katt-blueprint-parser
1 compromised version
- Aug 16, 2022
Malware in some-buidler-plugin
1 compromised version
- Aug 16, 2022
Malware in perseus-build-settings
1 compromised version
- Aug 16, 2022
Malware in some-dependency
1 compromised version
- Aug 16, 2022
Malware in koa-colorful-logger
1 compromised version
- Aug 16, 2022
Malicious code in @illuvium/illuvium-design (npm)
- Aug 16, 2022
Malware in @illuvium/illuvium-design
1 compromised version
- Aug 16, 2022
Malicious code in @hmg-sucasa-npm/my-account-components (npm)
- Aug 16, 2022
Malware in @hmg-sucasa-npm/my-account-components
1 compromised version
- Aug 16, 2022
Malicious code in fetch-string (npm)
- Aug 16, 2022
Malware in fetch-string
1 compromised version
- Aug 16, 2022
Malicious code in wb-web-utils (npm)
- Aug 16, 2022
Malware in wb-web-utils
1 compromised version
- Aug 16, 2022
Malicious code in data.chain.link (npm)
- Aug 16, 2022
Malware in data.chain.link
1 compromised version
- Aug 16, 2022
Malicious code in amplitude-ts (npm)
- Aug 16, 2022
Malware in amplitude-ts
1 compromised version
- Aug 16, 2022
Malicious code in rmesse-utils (npm)
- Aug 16, 2022
Malware in rmesse-utils
1 compromised version
- Aug 16, 2022
Malicious code in nodejs-color (npm)
- Aug 16, 2022
Malware in nodejs-color
1 compromised version
- Aug 16, 2022
Malicious code in mempoolrouter (npm)
- Aug 16, 2022
Malware in mempoolrouter
1 compromised version
- Aug 16, 2022
Malicious code in amex-eapply-dxp-component-button (npm)
- Aug 16, 2022
Malware in amex-eapply-dxp-component-button
1 compromised version
Page 7052 of 7,293