Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malicious code in checkpackagejson (npm)
- Jun 20, 2022
Malware in checkpackagejson
1 compromised version
- Jun 20, 2022
Malware in eslint-plugin-orbit-kotko
1 compromised version
- Jun 20, 2022
Malware in eslint-plugin-orbit-internal
1 compromised version
- Jun 20, 2022
Malicious code in wp-scripts (npm)
- Jun 20, 2022
Malicious code in swisscom (npm)
- Jun 20, 2022
Malicious code in npp-analytics (npm)
- Jun 20, 2022
Malicious code in kottestpackage (npm)
- Jun 20, 2022
Malicious code in depconftesttest (npm)
- Jun 20, 2022
Malware in depconftesttest
1 compromised version
- Jun 20, 2022
Malware in swisscom
1 compromised version
- Jun 20, 2022
Malware in kottestpackage
1 compromised version
- Jun 20, 2022
Malware in wp-scripts
1 compromised version
- Jun 20, 2022
Malware in npp-analytics
1 compromised version
- Jun 20, 2022
Malicious code in administracja_reklamowa (npm)
- Jun 20, 2022
Malicious code in wakacje-frontend-salki-neon (npm)
- Jun 20, 2022
Malicious code in wak-app (npm)
- Jun 20, 2022
Malicious code in pako-admin (npm)
- Jun 20, 2022
Malware in pako-admin
1 compromised version
- Jun 20, 2022
Malware in wak-app
1 compromised version
- Jun 20, 2022
Malware in wakacje-frontend-salki-neon
1 compromised version
- Jun 20, 2022
Malware in administracja_reklamowa
1 compromised version
- Jun 20, 2022
Malicious code in wpjslib (npm)
- Jun 20, 2022
Malicious code in peraichi (npm)
- Jun 20, 2022
Malicious code in opbox-build-tools (npm)
- Jun 20, 2022
Malicious code in kintro (npm)
- Jun 20, 2022
Malware in wpjslib
1 compromised version
- Jun 20, 2022
Malware in peraichi
1 compromised version
- Jun 20, 2022
Malware in opbox-build-tools
1 compromised version
- Jun 20, 2022
Malware in kintro
1 compromised version
- Jun 20, 2022
Malicious code in zalopay-payment-sdk (npm)
- Jun 20, 2022
Malicious code in web-portal (npm)
- Jun 20, 2022
Malicious code in com.unity.textmeshpro (npm)
- Jun 20, 2022
Malicious code in cart-client-js (npm)
- Jun 20, 2022
Malicious code in bc-modal (npm)
- Jun 20, 2022
Malware in cart-client-js
1 compromised version
- Jun 20, 2022
Malware in web-portal
1 compromised version
- Jun 20, 2022
Malware in com.unity.textmeshpro
1 compromised version
- Jun 20, 2022
Malware in bc-modal
1 compromised version
- Jun 20, 2022
Malware in zalopay-payment-sdk
1 compromised version
- Jun 20, 2022
Malicious code in ad-params (npm)
- Jun 20, 2022
Malicious code in shakademoassetinfo (npm)
- Jun 20, 2022
Malicious code in is-meta (npm)
- Jun 20, 2022
Malware in is-meta
1 compromised version
- Jun 20, 2022
Malware in shakademoassetinfo
1 compromised version
- Jun 20, 2022
Malware in ad-params
1 compromised version
- Jun 20, 2022
Malicious code in shared-sku-app (npm)
- Jun 20, 2022
Malicious code in load-date (npm)
- Jun 20, 2022
Malicious code in jugnnnnnuuuuu (npm)
- Jun 20, 2022
Malicious code in jekyll-tasks (npm)
Page 7093 of 7,293