Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,620 total · sorted newest first- Jul 20, 2022
Malware in discord.js-auth2
1 compromised version
- Jul 18, 2022
Malicious code in alertmanager-discord (npm)
- Jul 18, 2022
Malicious code in tranchess-core (npm)
- Jul 18, 2022
Malicious code in sushiswap-analytics (npm)
- Jul 18, 2022
Malicious code in sgn-explorer (npm)
- Jul 18, 2022
Malicious code in ptokens-erc777-smart-contract (npm)
- Jul 18, 2022
Malicious code in pancakeswap-v2-subgraph (npm)
- Jul 18, 2022
Malicious code in obyte-witness (npm)
- Jul 18, 2022
Malicious code in morpho-token (npm)
- Jul 18, 2022
Malicious code in lido-cosmos-docs (npm)
- Jul 18, 2022
Malicious code in kadenaswap-ui (npm)
- Jul 18, 2022
Malicious code in ib-subgraph (npm)
- Jul 18, 2022
Malicious code in headless-obyte (npm)
- Jul 18, 2022
Malicious code in dependencies-zksync (npm)
- Jul 18, 2022
Malicious code in cartesi-subgraph (npm)
- Jul 18, 2022
Malicious code in axelar-signing-relayer (npm)
- Jul 18, 2022
Malicious code in anytoken-locked (npm)
- Jul 18, 2022
Malicious code in anyswap-rewards (npm)
- Jul 18, 2022
Malware in dependencies-zksync
1 compromised version
- Jul 18, 2022
Malware in pancakeswap-v2-subgraph
1 compromised version
- Jul 18, 2022
Malware in obyte-witness
1 compromised version
- Jul 18, 2022
Malware in kadenaswap-ui
1 compromised version
- Jul 18, 2022
Malware in alertmanager-discord
1 compromised version
- Jul 18, 2022
Malware in cartesi-subgraph
1 compromised version
- Jul 18, 2022
Malware in lido-cosmos-docs
1 compromised version
- Jul 18, 2022
Malware in morpho-token
1 compromised version
- Jul 18, 2022
Malware in sushiswap-analytics
1 compromised version
- Jul 18, 2022
Malware in anyswap-rewards
1 compromised version
- Jul 18, 2022
Malware in ptokens-erc777-smart-contract
1 compromised version
- Jul 18, 2022
Malware in anytoken-locked
1 compromised version
- Jul 18, 2022
Malware in sgn-explorer
1 compromised version
- Jul 18, 2022
Malware in headless-obyte
1 compromised version
- Jul 18, 2022
Malware in tranchess-core
1 compromised version
- Jul 18, 2022
Malware in axelar-signing-relayer
1 compromised version
- Jul 18, 2022
Malware in ib-subgraph
1 compromised version
- Jul 18, 2022
Malicious code in @gettilled/tslint-preset (npm)
- Jul 18, 2022
Malicious code in @gettilled/commitlint-preset (npm)
- Jul 18, 2022
Malware in @gettilled/commitlint-preset
1 compromised version
- Jul 18, 2022
Malware in @gettilled/tslint-preset
1 compromised version
- Jul 18, 2022
Malicious code in ks-log (npm)
- Jul 18, 2022
Malware in ks-log
1 compromised version
- Jul 18, 2022
Malicious code in discord.js-selfbot-v15 (npm)
- Jul 18, 2022
Malicious code in discord.js-request (npm)
- Jul 18, 2022
Malware in discord.js-request
1 compromised version
- Jul 18, 2022
Malware in discord.js-selfbot-v15
1 compromised version
- Jul 14, 2022
Malicious code in discord.js-11 (npm)
3 compromised versions
- Jul 14, 2022
Malicious code in api-discord.js (npm)
- Jul 14, 2022
Malware in api-discord.js
1 compromised version
- Jul 14, 2022
Malware in discord.js-11
1 compromised version
- Jul 14, 2022
Malicious code in capitain-title (npm)
Page 7065 of 7,293