Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in ucs-tooltip
1 compromised version
- Jun 20, 2022
Malware in noblox.js-proxy
1 compromised version
- Jun 20, 2022
Malicious code in here_lead_generation_v2 (npm)
- Jun 20, 2022
Malicious code in here_cta_marketo_v2 (npm)
- Jun 20, 2022
Malicious code in here_base_theme_v2 (npm)
- Jun 20, 2022
Malicious code in here_base (npm)
- Jun 20, 2022
Malware in here_base
1 compromised version
- Jun 20, 2022
Malware in here_lead_generation_v2
1 compromised version
- Jun 20, 2022
Malware in here_base_theme_v2
1 compromised version
- Jun 20, 2022
Malware in here_cta_marketo_v2
1 compromised version
- Jun 20, 2022
Malicious code in uitk-react-icons (npm)
- Jun 20, 2022
Malicious code in uitk-react-cards (npm)
- Jun 20, 2022
Malicious code in tilled-api-client (npm)
- Jun 20, 2022
Malicious code in danafonts (npm)
- Jun 20, 2022
Malware in danafonts
1 compromised version
- Jun 20, 2022
Malware in tilled-api-client
1 compromised version
- Jun 20, 2022
Malware in uitk-react-icons
1 compromised version
- Jun 20, 2022
Malware in uitk-react-cards
1 compromised version
- Jun 20, 2022
Malicious code in sport-components (npm)
- Jun 20, 2022
Malicious code in federalist-uswds-jekyll (npm)
- Jun 20, 2022
Malicious code in danalibs (npm)
- Jun 20, 2022
Malicious code in danaicons (npm)
- Jun 20, 2022
Malicious code in dana-desktop (npm)
- Jun 20, 2022
Malware in danalibs
1 compromised version
- Jun 20, 2022
Malware in federalist-uswds-jekyll
1 compromised version
- Jun 20, 2022
Malware in sport-components
1 compromised version
- Jun 20, 2022
Malware in danaicons
1 compromised version
- Jun 20, 2022
Malware in dana-desktop
1 compromised version
- Jun 20, 2022
Malicious code in vrt-mediaplayer (npm)
- Jun 20, 2022
Malicious code in upaya (npm)
- Jun 20, 2022
Malicious code in standup-bot (npm)
- Jun 20, 2022
Malicious code in nih-ncats-translator (npm)
- Jun 20, 2022
Malware in standup-bot
1 compromised version
- Jun 20, 2022
Malware in vrt-mediaplayer
1 compromised version
- Jun 20, 2022
Malware in upaya
1 compromised version
- Jun 20, 2022
Malware in nih-ncats-translator
1 compromised version
- Jun 20, 2022
Malicious code in sbirez (npm)
- Jun 20, 2022
Malicious code in fbopen-api (npm)
- Jun 20, 2022
Malicious code in 18f-dashboard (npm)
- Jun 20, 2022
Malicious code in beckley (npm)
- Jun 20, 2022
Malware in sbirez
1 compromised version
- Jun 20, 2022
Malware in beckley
1 compromised version
- Jun 20, 2022
Malware in fbopen-api
1 compromised version
- Jun 20, 2022
Malware in 18f-dashboard
1 compromised version
- Jun 20, 2022
Malicious code in vue-cumulio-dashboard (npm)
- Jun 20, 2022
Malicious code in k-paste (npm)
- Jun 20, 2022
Malicious code in hub-http (npm)
- Jun 20, 2022
Malicious code in hs-lodash (npm)
- Jun 20, 2022
Malware in hs-lodash
1 compromised version
- Jun 20, 2022
Malware in vue-cumulio-dashboard
1 compromised version
Page 7095 of 7,293