Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malicious code in @porting-assistant/electron (npm)
- Jun 20, 2022
Malicious code in @porting-assistant/csharp (npm)
- Jun 20, 2022
Malware in @porting-assistant/electron
1 compromised version
- Jun 20, 2022
Malware in test1_l3yx
1 compromised version
- Jun 20, 2022
Malware in @porting-assistant/csharp
1 compromised version
- Jun 20, 2022
Malware in @porting-assistant/react
1 compromised version
- Jun 20, 2022
Malicious code in yelp-beans (npm)
- Jun 20, 2022
Malicious code in test4948 (npm)
- Jun 20, 2022
Malicious code in @porting-assistant/integration-test (npm)
- Jun 20, 2022
Malicious code in curiouscat (npm)
- Jun 20, 2022
Malware in @porting-assistant/integration-test
1 compromised version
- Jun 20, 2022
Malware in test4948
1 compromised version
- Jun 20, 2022
Malware in curiouscat
1 compromised version
- Jun 20, 2022
Malware in yelp-beans
1 compromised version
- Jun 20, 2022
Malicious code in paypay-sample-ecommerce-server (npm)
- Jun 20, 2022
Malicious code in paypay-ecommerce-miniapp (npm)
- Jun 20, 2022
Malicious code in facebook-nodejs-business-sdk-tests (npm)
- Jun 20, 2022
Malware in facebook-nodejs-business-sdk-tests
1 compromised version
- Jun 20, 2022
Malware in paypay-ecommerce-miniapp
1 compromised version
- Jun 20, 2022
Malware in paypay-sample-ecommerce-server
1 compromised version
- Jun 20, 2022
Malicious code in accenture-react-scripts (npm)
- Jun 20, 2022
Malicious code in techtalkui (npm)
- Jun 20, 2022
Malicious code in simple_cups-handler (npm)
- Jun 20, 2022
Malicious code in azuredatastudio-postgresql (npm)
- Jun 20, 2022
Malware in accenture-react-scripts
1 compromised version
- Jun 20, 2022
Malware in azuredatastudio-postgresql
1 compromised version
- Jun 20, 2022
Malware in techtalkui
1 compromised version
- Jun 20, 2022
Malware in simple_cups-handler
1 compromised version
- Jun 20, 2022
Malicious code in accessibility-insights-web (npm)
- Jun 20, 2022
Malicious code in testy4948 (npm)
- Jun 20, 2022
Malicious code in param_projectnametolower (npm)
- Jun 20, 2022
Malicious code in handbook-epub (npm)
- Jun 20, 2022
Malware in testy4948
1 compromised version
- Jun 20, 2022
Malware in param_projectnametolower
1 compromised version
- Jun 20, 2022
Malware in handbook-epub
1 compromised version
- Jun 20, 2022
Malware in accessibility-insights-web
1 compromised version
- Jun 20, 2022
Malicious code in @qcsfe/venus-token (npm)
- Jun 20, 2022
Malicious code in @md-fe/antd-upload (npm)
- Jun 20, 2022
Malicious code in @ling-web/psdviewer (npm)
- Jun 20, 2022
Malicious code in @blockpro/render (npm)
- Jun 20, 2022
Malware in @qcsfe/venus-token
1 compromised version
- Jun 20, 2022
Malware in @blockpro/render
1 compromised version
- Jun 20, 2022
Malware in @md-fe/antd-upload
1 compromised version
- Jun 20, 2022
Malware in @ling-web/psdviewer
1 compromised version
- Jun 20, 2022
Malicious code in @qwui/wallet (npm)
- Jun 20, 2022
Malicious code in @qwui/core (npm)
- Jun 20, 2022
Malicious code in @qcsfe/qnode (npm)
- Jun 20, 2022
Malicious code in @qcsfe/common-progressbar (npm)
- Jun 20, 2022
Malicious code in @qcsfe/common-lmap (npm)
- Jun 20, 2022
Malware in @qcsfe/qnode
1 compromised version
Page 7098 of 7,293