Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jul 26, 2022
Malware in ot-daily-algorithm
1 compromised version
- Jul 26, 2022
Malware in ot-pausedetector
1 compromised version
- Jul 26, 2022
Malware in ot-performance
1 compromised version
- Jul 26, 2022
Malware in ot-menu-test
1 compromised version
- Jul 26, 2022
Malicious code in stringjs_lib (npm)
- Jul 26, 2022
Malware in stringjs_lib
1 compromised version
- Jul 26, 2022
Malicious code in chat-orion-sdk (npm)
- Jul 26, 2022
Malware in chat-orion-sdk
1 compromised version
- Jul 26, 2022
Malicious code in mongodb-stitch-browser-testutils (npm)
- Jul 26, 2022
Malware in mongodb-stitch-browser-testutils
1 compromised version
- Jul 26, 2022
Malicious code in ys-mozi-metrics (npm)
- Jul 26, 2022
Malicious code in mozi-metrics (npm)
- Jul 26, 2022
Malware in mozi-metrics
1 compromised version
- Jul 26, 2022
Malware in ys-mozi-metrics
1 compromised version
- Jul 26, 2022
Malicious code in ovhcatalogs (npm)
- Jul 26, 2022
Malicious code in order-link-builder (npm)
- Jul 26, 2022
Malicious code in dedicated-servers (npm)
- Jul 26, 2022
Malware in dedicated-servers
1 compromised version
- Jul 26, 2022
Malware in order-link-builder
1 compromised version
- Jul 26, 2022
Malware in ovhcatalogs
1 compromised version
- Jul 26, 2022
Malicious code in @ovh-ui/oui-spinner (npm)
- Jul 26, 2022
Malicious code in @ovh-ui/oui-pagination (npm)
- Jul 26, 2022
Malware in @ovh-ui/oui-pagination
1 compromised version
- Jul 26, 2022
Malware in @ovh-ui/oui-spinner
1 compromised version
- Jul 26, 2022
Malicious code in @ovh-ui/oui-criteria (npm)
- Jul 26, 2022
Malware in @ovh-ui/oui-criteria
1 compromised version
- Jul 26, 2022
Malicious code in postman-echo-nock (npm)
- Jul 26, 2022
Malicious code in nsmalkasm (npm)
- Jul 26, 2022
Malicious code in eslint-plugin-internal (npm)
- Jul 26, 2022
Malware in eslint-plugin-internal
1 compromised version
- Jul 26, 2022
Malware in postman-echo-nock
1 compromised version
- Jul 26, 2022
Malware in nsmalkasm
1 compromised version
- Jul 26, 2022
Malicious code in volpino-italiano-content (npm)
- Jul 26, 2022
Malicious code in treeing-cur-content (npm)
- Jul 26, 2022
Malicious code in shiba-inu-technologies (npm)
- Jul 26, 2022
Malicious code in pug-web-readiness (npm)
- Jul 26, 2022
Malicious code in my-very-first-own-package (npm)
- Jul 26, 2022
Malicious code in bulldog-e-business (npm)
- Jul 26, 2022
Malicious code in austrian-black-and-tan-hound-platforms (npm)
- Jul 26, 2022
Malware in shiba-inu-technologies
1 compromised version
- Jul 26, 2022
Malware in austrian-black-and-tan-hound-platforms
1 compromised version
- Jul 26, 2022
Malware in my-very-first-own-package
1 compromised version
- Jul 26, 2022
Malware in pug-web-readiness
1 compromised version
- Jul 26, 2022
Malware in treeing-cur-content
1 compromised version
- Jul 26, 2022
Malware in volpino-italiano-content
1 compromised version
- Jul 26, 2022
Malware in bulldog-e-business
1 compromised version
- Jul 26, 2022
Malicious code in vue-test-utils-mic (npm)
- Jul 26, 2022
Malware in vue-test-utils-mic
1 compromised version
- Jul 26, 2022
Malicious code in wetimejs-twilio-internal (npm)
- Jul 26, 2022
Malware in wetimejs-twilio-internal
1 compromised version
Page 7056 of 7,293