Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jul 25, 2022
Malware in twilio-bugcrowd-poc-twilio-flex-ui-sample
1 compromised version
- Jul 25, 2022
Malware in elementor-developers-docs
1 compromised version
- Jul 25, 2022
Malware in owncloud-guests
1 compromised version
- Jul 25, 2022
Malware in astar-portal-test-depconf
1 compromised version
- Jul 22, 2022
Malicious code in mail-core-git (npm)
- Jul 22, 2022
Malware in mail-core-git
1 compromised version
- Jul 22, 2022
Malicious code in @ucs-private/rollup-plugin-dts-bundle (npm)
- Jul 22, 2022
Malware in @ucs-private/rollup-plugin-dts-bundle
1 compromised version
- Jul 22, 2022
Malicious code in @foodplex/ui (npm)
- Jul 22, 2022
Malware in @foodplex/ui
1 compromised version
- Jul 22, 2022
Malicious code in @biz-vue/utils (npm)
- Jul 22, 2022
Malware in @biz-vue/utils
1 compromised version
- Jul 22, 2022
Malicious code in @ucs-private/kiosk-core (npm)
- Jul 22, 2022
Malware in @ucs-private/kiosk-core
1 compromised version
- Jul 22, 2022
Malicious code in widget-framework (npm)
- Jul 22, 2022
Malware in widget-framework
1 compromised version
- Jul 22, 2022
Malicious code in ac-appleicons (npm)
- Jul 22, 2022
Malware in ac-appleicons
1 compromised version
- Jul 22, 2022
Malicious code in pidl-react (npm)
- Jul 22, 2022
Malware in pidl-react
1 compromised version
- Jul 22, 2022
Malicious code in zohocomponents-react (npm)
- Jul 22, 2022
Malware in zohocomponents-react
1 compromised version
- Jul 22, 2022
Malicious code in coinsquare-css (npm)
- Jul 22, 2022
Malware in coinsquare-css
1 compromised version
- Jul 22, 2022
Malicious code in sf-http (npm)
- Jul 22, 2022
Malware in sf-http
1 compromised version
- Jul 22, 2022
Malicious code in yahoo-react-popup-select (npm)
- Jul 22, 2022
Malware in yahoo-react-popup-select
1 compromised version
- Jul 22, 2022
Malicious code in @unity-dashboard/iframe-messages (npm)
- Jul 22, 2022
Malicious code in @unity-dashboard/cloud-build (npm)
- Jul 22, 2022
Malware in @unity-dashboard/cloud-build
1 compromised version
- Jul 22, 2022
Malware in @unity-dashboard/iframe-messages
1 compromised version
- Jul 21, 2022
Malicious code in shaikh-test (npm)
- Jul 21, 2022
Malicious code in machine-mapper (npm)
- Jul 21, 2022
Malicious code in eslint-config-cap-it-ui (npm)
- Jul 21, 2022
Malicious code in deere-ui-toggle-group (npm)
- Jul 21, 2022
Malicious code in deere-ui-multiselect (npm)
- Jul 21, 2022
Malicious code in deere-ui-modal-core (npm)
- Jul 21, 2022
Malicious code in deere-ui-loader (npm)
- Jul 21, 2022
Malicious code in deere-ui-framework (npm)
- Jul 21, 2022
Malicious code in deere-ui-branding-ag (npm)
- Jul 21, 2022
Malicious code in deere-ui-basic-dialog (npm)
- Jul 21, 2022
Malicious code in competitive-equipment-icon (npm)
- Jul 21, 2022
Malware in machine-mapper
1 compromised version
- Jul 21, 2022
Malware in deere-ui-toggle-group
1 compromised version
- Jul 21, 2022
Malware in deere-ui-basic-dialog
1 compromised version
- Jul 21, 2022
Malware in eslint-config-cap-it-ui
1 compromised version
- Jul 21, 2022
Malware in competitive-equipment-icon
1 compromised version
- Jul 21, 2022
Malware in deere-ui-framework
1 compromised version
- Jul 21, 2022
Malware in deere-ui-modal-core
1 compromised version
Page 7059 of 7,293