Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,620 total · sorted newest first- Jul 8, 2022
Malicious code in tjhnl (npm)
- Jul 8, 2022
Malware in tmeme
1 compromised version
- Jul 8, 2022
Malware in tjhnl
1 compromised version
- Jul 8, 2022
Malicious code in wallet-recovery-wizard (npm)
- Jul 8, 2022
Malicious code in ben1 (npm)
- Jul 8, 2022
Malware in ben1
1 compromised version
- Jul 8, 2022
Malware in wallet-recovery-wizard
1 compromised version
- Jul 8, 2022
Malicious code in test-aaa-yyyy-zzz (npm)
- Jul 8, 2022
Malicious code in specproject-template (npm)
- Jul 8, 2022
Malware in specproject-template
1 compromised version
- Jul 8, 2022
Malware in test-aaa-yyyy-zzz
1 compromised version
- Jul 8, 2022
Malicious code in pegleg_heart (npm)
- Jul 8, 2022
Malware in pegleg_heart
1 compromised version
- Jul 8, 2022
Malicious code in internallib_v847 (npm)
- Jul 8, 2022
Malicious code in @inaciot/internallib_v243 (npm)
- Jul 8, 2022
Malware in internallib_v847
1 compromised version
- Jul 8, 2022
Malware in @inaciot/internallib_v243
1 compromised version
- Jul 8, 2022
Malicious code in skyscanner.github.io (npm)
- Jul 8, 2022
Malware in skyscanner.github.io
1 compromised version
- Jul 8, 2022
Malicious code in teamcity-cloud-agent-updater (npm)
- Jul 8, 2022
Malicious code in sketch-pexels (npm)
- Jul 8, 2022
Malicious code in legendggwp (npm)
- Jul 8, 2022
Malware in legendggwp
1 compromised version
- Jul 8, 2022
Malware in sketch-pexels
1 compromised version
- Jul 8, 2022
Malware in teamcity-cloud-agent-updater
1 compromised version
- Jul 8, 2022
Malicious code in sync-process (npm)
- Jul 8, 2022
Malicious code in small-ms (npm)
- Jul 8, 2022
Malicious code in node-child (npm)
- Jul 8, 2022
Malicious code in emojis-discord (npm)
- Jul 8, 2022
Malware in small-ms
1 compromised version
- Jul 8, 2022
Malware in emojis-discord
1 compromised version
- Jul 8, 2022
Malware in sync-process
1 compromised version
- Jul 8, 2022
Malware in node-child
1 compromised version
- Jul 6, 2022
Malicious code in package-ionicons (npm)
1 compromised version
- Jul 6, 2022
Malicious code in package-ionicon (npm)
1 compromised version
- Jul 6, 2022
Malicious code in ionicons-json (npm)
1 compromised version
- Jul 6, 2022
Malicious code in ionicons-js (npm)
1 compromised version
- Jul 6, 2022
Malicious code in base64-javascript (npm)
1 compromised version
- Jul 6, 2022
Malware in package-ionicon
1 compromised version
- Jul 6, 2022
Malware in base64-javascript
1 compromised version
- Jul 6, 2022
Malware in ionicons-json
1 compromised version
- Jul 6, 2022
Malware in package-ionicons
1 compromised version
- Jul 6, 2022
Malware in ionicons-js
1 compromised version
- Jul 6, 2022
Malicious code in script-package (npm)
- Jul 6, 2022
Malicious code in pack-icons (npm)
1 compromised version
- Jul 6, 2022
Malicious code in ionicons-pack (npm)
1 compromised version
- Jul 6, 2022
Malicious code in ionicon-package (npm)
1 compromised version
- Jul 6, 2022
Malicious code in icons-packages (npm)
1 compromised version
- Jul 6, 2022
Malicious code in icons-pack (npm)
1 compromised version
- Jul 6, 2022
Malware in ionicon-package
1 compromised version
Page 7085 of 7,293