Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Aug 16, 2022
Malicious code in coinmarketcap.com (npm)
- Aug 16, 2022
Malware in coinmarketcap.com
1 compromised version
- Aug 15, 2022
Malicious code in usaa-template-mocks-aggregate (npm)
- Aug 15, 2022
Malicious code in usaa-mocks-proxy (npm)
- Aug 15, 2022
Malicious code in usaa-dls-build-utils (npm)
- Aug 15, 2022
Malware in usaa-template-mocks-aggregate
1 compromised version
- Aug 15, 2022
Malware in usaa-mocks-proxy
1 compromised version
- Aug 15, 2022
Malware in usaa-dls-build-utils
1 compromised version
- Aug 11, 2022
Malicious code in rustdecimal (crates.io)
- Aug 11, 2022
`rustdecimal` is a malicious crate
- Aug 10, 2022
Malicious code in react_popper_old (npm)
- Aug 10, 2022
Malware in react_popper_old
1 compromised version
- Aug 10, 2022
Malicious code in quest-bee-nodejs (npm)
- Aug 10, 2022
Malware in quest-bee-nodejs
1 compromised version
- Aug 10, 2022
Malicious code in tracking-pixel (npm)
- Aug 10, 2022
Malicious code in tezos-sdk (npm)
- Aug 10, 2022
Malicious code in marketplace-benchmarks (npm)
- Aug 10, 2022
Malicious code in gen-mapping (npm)
- Aug 10, 2022
Malware in tracking-pixel
1 compromised version
- Aug 10, 2022
Malware in marketplace-benchmarks
1 compromised version
- Aug 10, 2022
Malware in gen-mapping
1 compromised version
- Aug 10, 2022
Malware in tezos-sdk
1 compromised version
- Aug 10, 2022
Malicious code in tokenary-web3-provider (npm)
- Aug 10, 2022
Malicious code in tbb (npm)
- Aug 10, 2022
Malicious code in magic-internet-money (npm)
- Aug 10, 2022
Malicious code in com.apple.core (npm)
- Aug 10, 2022
Malware in tbb
1 compromised version
- Aug 10, 2022
Malware in tokenary-web3-provider
1 compromised version
- Aug 10, 2022
Malware in magic-internet-money
1 compromised version
- Aug 10, 2022
Malware in com.apple.core
1 compromised version
- Aug 10, 2022
Malicious code in zksync-zkwallet-vue (npm)
- Aug 10, 2022
Malicious code in ptokens-website-backend (npm)
- Aug 10, 2022
Malware in zksync-zkwallet-vue
1 compromised version
- Aug 10, 2022
Malware in ptokens-website-backend
1 compromised version
- Aug 10, 2022
Malicious code in testdonotinstall (npm)
- Aug 10, 2022
Malware in testdonotinstall
1 compromised version
- Aug 9, 2022
Malicious code in pancake-lottery-scheduler (npm)
- Aug 9, 2022
Malicious code in pancake-info-api (npm)
- Aug 9, 2022
Malicious code in iotex-explorer (npm)
- Aug 9, 2022
Malicious code in gatsby-pancake-api (npm)
- Aug 9, 2022
Malware in pancake-info-api
1 compromised version
- Aug 9, 2022
Malware in iotex-explorer
1 compromised version
- Aug 9, 2022
Malware in pancake-lottery-scheduler
1 compromised version
- Aug 9, 2022
Malware in gatsby-pancake-api
1 compromised version
- Aug 5, 2022
Malicious code in @m365-admin/utilities (npm)
2 compromised versions
- Aug 5, 2022
Malicious code in @m365-admin/nav (npm)
2 compromised versions
- Aug 5, 2022
Malware in @m365-admin/utilities
1 compromised version
- Aug 5, 2022
Malware in @m365-admin/nav
1 compromised version
- Aug 5, 2022
Malicious code in @m365-admin/customizations (npm)
2 compromised versions
- Aug 5, 2022
Malware in @m365-admin/customizations
1 compromised version
Page 7053 of 7,293