Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jul 21, 2022
Malicious code in rondo-saga (npm)
- Jul 21, 2022
Malware in rondo-saga
1 compromised version
- Jul 21, 2022
Malicious code in web-stories-renderer (npm)
- Jul 21, 2022
Malware in web-stories-renderer
1 compromised version
- Jul 21, 2022
Malicious code in @exnessimus/hooks (npm)
- Jul 21, 2022
Malware in @exnessimus/hooks
1 compromised version
- Jul 21, 2022
Malicious code in @pingone/net (npm)
- Jul 21, 2022
Malware in @pingone/net
1 compromised version
- Jul 21, 2022
Malicious code in @byted-larklet/calendar (npm)
- Jul 21, 2022
Malware in @byted-larklet/calendar
1 compromised version
- Jul 21, 2022
Malicious code in poc-globalleakage (npm)
- Jul 21, 2022
Malware in poc-globalleakage
1 compromised version
- Jul 21, 2022
Malicious code in vulnerable-vkom (npm)
- Jul 21, 2022
Malware in vulnerable-vkom
1 compromised version
- Jul 21, 2022
Malicious code in list-images (npm)
- Jul 21, 2022
Malware in list-images
1 compromised version
- Jul 21, 2022
Malicious code in analytics.usa.gov (npm)
- Jul 21, 2022
Malicious code in tss-marketing (npm)
- Jul 21, 2022
Malicious code in sparhandy-speedtest (npm)
- Jul 21, 2022
Malicious code in search-gov-website (npm)
- Jul 21, 2022
Malicious code in phoenix.site (npm)
- Jul 21, 2022
Malicious code in identity-partners-site (npm)
- Jul 21, 2022
Malicious code in identity-dev-docs (npm)
- Jul 21, 2022
Malicious code in chargebyte (npm)
- Jul 21, 2022
Malware in sparhandy-speedtest
1 compromised version
- Jul 21, 2022
Malware in phoenix.site
1 compromised version
- Jul 21, 2022
Malware in analytics.usa.gov
1 compromised version
- Jul 21, 2022
Malware in search-gov-website
1 compromised version
- Jul 21, 2022
Malware in tss-marketing
1 compromised version
- Jul 21, 2022
Malware in identity-partners-site
1 compromised version
- Jul 21, 2022
Malware in identity-dev-docs
1 compromised version
- Jul 21, 2022
Malware in chargebyte
1 compromised version
- Jul 21, 2022
Malicious code in accent.jobs (npm)
- Jul 21, 2022
Malicious code in web-kore-sdk (npm)
- Jul 21, 2022
Malicious code in unibet_package (npm)
- Jul 21, 2022
Malicious code in ua-publication-manager (npm)
- Jul 21, 2022
Malicious code in style-guide-microsite (npm)
- Jul 21, 2022
Malicious code in starbuckssystem.website (npm)
- Jul 21, 2022
Malicious code in serverless-push-hasura (npm)
- Jul 21, 2022
Malicious code in sales-demo (npm)
- Jul 21, 2022
Malicious code in rsk-devportal (npm)
- Jul 21, 2022
Malicious code in rg-engineering (npm)
- Jul 21, 2022
Malicious code in promohline (npm)
- Jul 21, 2022
Malicious code in portail-web (npm)
- Jul 21, 2022
Malicious code in nozbedesktop (npm)
- Jul 21, 2022
Malicious code in mofronts (npm)
- Jul 21, 2022
Malicious code in ledger-live-assets (npm)
- Jul 21, 2022
Malicious code in kinesis-app-panel (npm)
- Jul 21, 2022
Malicious code in kenticodevelopmentconfiguration (npm)
- Jul 21, 2022
Malicious code in irisk (npm)
Page 7061 of 7,293