Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Aug 5, 2022
Malicious code in test6a1i4los (npm)
- Aug 5, 2022
Malware in test6a1i4los
1 compromised version
- Aug 5, 2022
Malicious code in token_supply (npm)
- Aug 5, 2022
Malware in token_supply
1 compromised version
- Aug 3, 2022
Malicious code in ing-orange-corporatekey-password-authentication (npm)
- Aug 3, 2022
Malware in ing-orange-corporatekey-password-authentication
1 compromised version
- Aug 3, 2022
Malicious code in ing-lib-authenticate (npm)
- Aug 3, 2022
Malware in ing-lib-authenticate
1 compromised version
- Aug 2, 2022
Malicious code in mep-widget-localizer (npm)
- Aug 2, 2022
Malware in mep-widget-localizer
1 compromised version
- Aug 2, 2022
Malicious code in chawla-init-3 (npm)
- Aug 2, 2022
Malware in chawla-init-3
1 compromised version
- Aug 2, 2022
Malicious code in pplogger-paypal (npm)
- Aug 2, 2022
Malware in pplogger-paypal
1 compromised version
- Aug 2, 2022
Malicious code in lwc-playground (npm)
- Aug 2, 2022
Malware in lwc-playground
1 compromised version
- Aug 2, 2022
Malicious code in ai-image-tagging-lambda (npm)
- Aug 2, 2022
Malicious code in zoho-app (npm)
- Aug 2, 2022
Malicious code in pm-manager (npm)
- Aug 2, 2022
Malicious code in npm-dependency-submission-example (npm)
- Aug 2, 2022
Malicious code in maps-api-for-javascript (npm)
- Aug 2, 2022
Malicious code in f36-components (npm)
- Aug 2, 2022
Malicious code in dependency-submission-toolkit (npm)
- Aug 2, 2022
Malware in pm-manager
1 compromised version
- Aug 2, 2022
Malware in ai-image-tagging-lambda
1 compromised version
- Aug 2, 2022
Malware in f36-components
1 compromised version
- Aug 2, 2022
Malware in dependency-submission-toolkit
1 compromised version
- Aug 2, 2022
Malware in npm-dependency-submission-example
1 compromised version
- Aug 2, 2022
Malware in maps-api-for-javascript
1 compromised version
- Aug 2, 2022
Malware in zoho-app
1 compromised version
- Aug 2, 2022
Malicious code in anchor-website-common (npm)
- Aug 2, 2022
Malware in anchor-website-common
1 compromised version
- Aug 2, 2022
Malicious code in colorss (npm)
- Aug 2, 2022
Malicious code in colors-2.2.2 (npm)
- Aug 2, 2022
Malware in colors-2.2.2
1 compromised version
- Aug 2, 2022
Malware in colorss
1 compromised version
- Aug 2, 2022
Malicious code in swan-buyer (npm)
- Aug 2, 2022
Malicious code in panel-farm (npm)
- Aug 2, 2022
Malicious code in avax-js-cli-tools (npm)
- Aug 2, 2022
Malware in swan-buyer
1 compromised version
- Aug 2, 2022
Malware in avax-js-cli-tools
1 compromised version
- Aug 2, 2022
Malware in panel-farm
1 compromised version
- Aug 2, 2022
Malicious code in dolphin-database (npm)
- Aug 2, 2022
Malware in dolphin-database
1 compromised version
- Jul 29, 2022
Malicious code in protons-benchmark (npm)
- Jul 29, 2022
Malicious code in matchmaking-mgmt (npm)
- Jul 29, 2022
Malicious code in flipper-server-companion (npm)
- Jul 29, 2022
Malware in matchmaking-mgmt
1 compromised version
- Jul 29, 2022
Malware in flipper-server-companion
1 compromised version
- Jul 29, 2022
Malware in protons-benchmark
1 compromised version
Page 7054 of 7,293