Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malicious code in @timsuchanek/eb-test (npm)
- Jun 20, 2022
Malicious code in @sbtweb/chat-ui (npm)
- Jun 20, 2022
Malicious code in angular-directive-seed (npm)
- Jun 20, 2022
Malware in angular-directive-seed
1 compromised version
- Jun 20, 2022
Malware in @sbtweb/chat-ui
1 compromised version
- Jun 20, 2022
Malware in @timsuchanek/eb-test
1 compromised version
- Jun 20, 2022
Malware in @zeos-libs/auth-client
1 compromised version
- Jun 20, 2022
Malware in abbsjshshs
1 compromised version
- Jun 20, 2022
Malicious code in abunews-components (npm)
- Jun 20, 2022
Malicious code in abu-news-api (npm)
- Jun 20, 2022
Malicious code in ykeykey-setup (npm)
- Jun 20, 2022
Malicious code in luc1f3rhk1-test2 (npm)
- Jun 20, 2022
Malware in abu-news-api
1 compromised version
- Jun 20, 2022
Malware in ykeykey-setup
1 compromised version
- Jun 20, 2022
Malware in luc1f3rhk1-test2
1 compromised version
- Jun 20, 2022
Malware in abunews-components
1 compromised version
- Jun 20, 2022
Malicious code in acookie (npm)
- Jun 20, 2022
Malicious code in ykeykey-getkey (npm)
- Jun 20, 2022
Malicious code in noblox.js-proxies (npm)
- Jun 20, 2022
Malicious code in luc1f3rhk1-test (npm)
- Jun 20, 2022
Malware in ykeykey-getkey
1 compromised version
- Jun 20, 2022
Malware in luc1f3rhk1-test
1 compromised version
- Jun 20, 2022
Malware in acookie
1 compromised version
- Jun 20, 2022
Malware in noblox.js-proxies
1 compromised version
- Jun 20, 2022
Malicious code in @sdc-wob-type-3/group-ui (npm)
- Jun 20, 2022
Malicious code in dinesh-dev-nagajikkktest11223qa (npm)
- Jun 20, 2022
Malware in @sdc-wob-type-3/group-ui
1 compromised version
- Jun 20, 2022
Malware in dinesh-dev-nagajikkktest11223qa
1 compromised version
- Jun 20, 2022
Malicious code in mcs-landings-blocks (npm)
- Jun 20, 2022
Malicious code in mcs-landings-api (npm)
- Jun 20, 2022
Malicious code in lolo0093 (npm)
- Jun 20, 2022
Malware in lolo0093
1 compromised version
- Jun 20, 2022
Malware in mcs-landings-api
1 compromised version
- Jun 20, 2022
Malware in mcs-landings-blocks
1 compromised version
- Jun 20, 2022
Malicious code in mitek-science-mweb-sdk (npm)
- Jun 20, 2022
Malware in mitek-science-mweb-sdk
1 compromised version
- Jun 20, 2022
Malicious code in superset-websocket (npm)
- Jun 20, 2022
Malicious code in sifchain (npm)
- Jun 20, 2022
Malicious code in nethouse-ui (npm)
- Jun 20, 2022
Malicious code in nat-sdk-web (npm)
- Jun 20, 2022
Malware in superset-websocket
1 compromised version
- Jun 20, 2022
Malware in sifchain
1 compromised version
- Jun 20, 2022
Malware in nat-sdk-web
1 compromised version
- Jun 20, 2022
Malware in nethouse-ui
1 compromised version
- Jun 20, 2022
Malicious code in origami-registry-ui (npm)
- Jun 20, 2022
Malware in origami-registry-ui
1 compromised version
- Jun 20, 2022
Malicious code in how-to-mess-up (npm)
- Jun 20, 2022
Malware in how-to-mess-up
1 compromised version
- Jun 20, 2022
Malicious code in test1_l3yx (npm)
- Jun 20, 2022
Malicious code in @porting-assistant/react (npm)
Page 7097 of 7,293