Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in @qcsfe/common-lmap
1 compromised version
- Jun 20, 2022
Malware in @qwui/wallet
1 compromised version
- Jun 20, 2022
Malware in @qcsfe/common-progressbar
1 compromised version
- Jun 20, 2022
Malware in @qwui/core
1 compromised version
- Jun 20, 2022
Malicious code in @thrift-api/request (npm)
- Jun 20, 2022
Malicious code in @thrift-api/drivertrade-web (npm)
- Jun 20, 2022
Malicious code in com.google.play.comon (npm)
- Jun 20, 2022
Malicious code in com.google.play (npm)
- Jun 20, 2022
Malware in @thrift-api/drivertrade-web
1 compromised version
- Jun 20, 2022
Malware in @thrift-api/request
1 compromised version
- Jun 20, 2022
Malware in com.google.play.comon
1 compromised version
- Jun 20, 2022
Malware in com.google.play
1 compromised version
- Jun 20, 2022
Malicious code in meupkgdeteste (npm)
- Jun 20, 2022
Malicious code in hl7.fhir (npm)
- Jun 20, 2022
Malicious code in elm-combine (npm)
- Jun 20, 2022
Malicious code in com.google (npm)
- Jun 20, 2022
Malware in hl7.fhir
1 compromised version
- Jun 20, 2022
Malware in com.google
1 compromised version
- Jun 20, 2022
Malware in elm-combine
1 compromised version
- Jun 20, 2022
Malware in meupkgdeteste
1 compromised version
- Jun 20, 2022
Malicious code in validate-order (npm)
- Jun 20, 2022
Malicious code in samples-bootstrap-theme (npm)
- Jun 20, 2022
Malicious code in restaurant-approval (npm)
- Jun 20, 2022
Malicious code in realm-postgres-adapters (npm)
- Jun 20, 2022
Malware in samples-bootstrap-theme
1 compromised version
- Jun 20, 2022
Malware in restaurant-approval
1 compromised version
- Jun 20, 2022
Malware in realm-postgres-adapters
1 compromised version
- Jun 20, 2022
Malware in validate-order
1 compromised version
- Jun 20, 2022
Malicious code in agent-assignment (npm)
- Jun 20, 2022
Malicious code in actions-toolbox (npm)
- Jun 20, 2022
Malicious code in mapbox-gl-shaders (npm)
- Jun 20, 2022
Malicious code in createtile (npm)
- Jun 20, 2022
Malware in agent-assignment
1 compromised version
- Jun 20, 2022
Malware in createtile
1 compromised version
- Jun 20, 2022
Malware in actions-toolbox
1 compromised version
- Jun 20, 2022
Malware in mapbox-gl-shaders
1 compromised version
- Jun 20, 2022
Malicious code in wordpress-element (npm)
- Jun 20, 2022
Malicious code in reflect_decorators (npm)
- Jun 20, 2022
Malicious code in nubank-core (npm)
- Jun 20, 2022
Malicious code in newspack-blocks (npm)
- Jun 20, 2022
Malware in nubank-core
1 compromised version
- Jun 20, 2022
Malware in wordpress-element
1 compromised version
- Jun 20, 2022
Malware in reflect_decorators
1 compromised version
- Jun 20, 2022
Malware in newspack-blocks
1 compromised version
- Jun 20, 2022
Malicious code in test-old-npm-sub-dependency (npm)
- Jun 20, 2022
Malicious code in scrypt-shim (npm)
- Jun 20, 2022
Malicious code in edu-front-util (npm)
- Jun 20, 2022
Malicious code in duo_web_sdk (npm)
- Jun 20, 2022
Malware in edu-front-util
1 compromised version
- Jun 20, 2022
Malware in duo_web_sdk
1 compromised version
Page 7099 of 7,293