Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in load-date
1 compromised version
- Jun 20, 2022
Malware in jugnnnnnuuuuu
1 compromised version
- Jun 20, 2022
Malware in jekyll-tasks
1 compromised version
- Jun 20, 2022
Malware in shared-sku-app
1 compromised version
- Jun 20, 2022
Malicious code in tokenizeutil (npm)
- Jun 20, 2022
Malicious code in token-registry-contracts (npm)
- Jun 20, 2022
Malicious code in rapidjson (npm)
- Jun 20, 2022
Malicious code in mock-jsx-module (npm)
- Jun 20, 2022
Malware in token-registry-contracts
1 compromised version
- Jun 20, 2022
Malware in mock-jsx-module
1 compromised version
- Jun 20, 2022
Malware in rapidjson
1 compromised version
- Jun 20, 2022
Malware in tokenizeutil
1 compromised version
- Jun 20, 2022
Malicious code in vue3-infinite-scroll (npm)
- Jun 20, 2022
Malicious code in smartcontractkit (npm)
- Jun 20, 2022
Malicious code in @pancakeswap-lib/sdk (npm)
- Jun 20, 2022
Malicious code in ember-qunit-notifications (npm)
- Jun 20, 2022
Malicious code in dustjs-linkedin-helpers (npm)
- Jun 20, 2022
Malware in dustjs-linkedin-helpers
1 compromised version
- Jun 20, 2022
Malware in ember-qunit-notifications
1 compromised version
- Jun 20, 2022
Malware in smartcontractkit
1 compromised version
- Jun 20, 2022
Malware in @pancakeswap-lib/sdk
1 compromised version
- Jun 20, 2022
Malware in vue3-infinite-scroll
1 compromised version
- Jun 20, 2022
Malicious code in tinkoff-web-tracking (npm)
- Jun 20, 2022
Malicious code in fin-common-snapshot (npm)
- Jun 20, 2022
Malicious code in codefest-internal-package (npm)
- Jun 20, 2022
Malicious code in codefest-internal-dependency (npm)
- Jun 20, 2022
Malicious code in appsec-internal-package (npm)
- Jun 20, 2022
Malware in appsec-internal-package
1 compromised version
- Jun 20, 2022
Malware in fin-common-snapshot
1 compromised version
- Jun 20, 2022
Malware in codefest-internal-dependency
1 compromised version
- Jun 20, 2022
Malware in codefest-internal-package
1 compromised version
- Jun 20, 2022
Malware in tinkoff-web-tracking
1 compromised version
- Jun 20, 2022
Malicious code in wof-prompter (npm)
- Jun 20, 2022
Malicious code in kleros-escrow (npm)
- Jun 20, 2022
Malicious code in caindemonode (npm)
- Jun 20, 2022
Malware in kleros-escrow
1 compromised version
- Jun 20, 2022
Malware in wof-prompter
1 compromised version
- Jun 20, 2022
Malware in caindemonode
1 compromised version
- Jun 20, 2022
Malicious code in xss-finder-0xsapra (npm)
- Jun 20, 2022
Malicious code in taf-three-dimensional-view (npm)
- Jun 20, 2022
Malware in taf-three-dimensional-view
1 compromised version
- Jun 20, 2022
Malware in xss-finder-0xsapra
1 compromised version
- Jun 20, 2022
Malicious code in asset-detect-filter (npm)
- Jun 20, 2022
Malware in asset-detect-filter
1 compromised version
- Jun 20, 2022
Malicious code in ucs-tooltip (npm)
- Jun 20, 2022
Malicious code in noblox.js-proxy (npm)
- Jun 20, 2022
Malicious code in fe-cookie-consent (npm)
- Jun 20, 2022
Malicious code in asset-detect-layout (npm)
- Jun 20, 2022
Malware in asset-detect-layout
1 compromised version
- Jun 20, 2022
Malware in fe-cookie-consent
1 compromised version
Page 7094 of 7,293