Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in scrypt-shim
1 compromised version
- Jun 20, 2022
Malware in test-old-npm-sub-dependency
1 compromised version
- Jun 20, 2022
Malicious code in uw-tools (npm)
- Jun 20, 2022
Malicious code in uw-demo-jest (npm)
- Jun 20, 2022
Malicious code in res-base (npm)
- Jun 20, 2022
Malicious code in @jmfe/jm-jdshare (npm)
- Jun 20, 2022
Malicious code in bisheng-plugin-uw (npm)
- Jun 20, 2022
Malware in res-base
1 compromised version
- Jun 20, 2022
Malware in @jmfe/jm-jdshare
1 compromised version
- Jun 20, 2022
Malware in uw-tools
1 compromised version
- Jun 20, 2022
Malware in bisheng-plugin-uw
1 compromised version
- Jun 20, 2022
Malware in uw-demo-jest
1 compromised version
- Jun 20, 2022
Malicious code in netless-ppt (npm)
- Jun 20, 2022
Malicious code in md-performance (npm)
- Jun 20, 2022
Malicious code in internal-hr-form-shared (npm)
- Jun 20, 2022
Malicious code in @jmfe/rollup-plugin-jss-upload (npm)
- Jun 20, 2022
Malware in netless-ppt
1 compromised version
- Jun 20, 2022
Malware in md-performance
1 compromised version
- Jun 20, 2022
Malware in internal-hr-form-shared
1 compromised version
- Jun 20, 2022
Malware in @jmfe/rollup-plugin-jss-upload
1 compromised version
- Jun 20, 2022
Malicious code in theme_dbtraining (npm)
- Jun 20, 2022
Malicious code in testingtesttencencent (npm)
- Jun 20, 2022
Malicious code in @cwdb/dnsinfo (npm)
- Jun 20, 2022
Malicious code in bob-app-core (npm)
- Jun 20, 2022
Malware in @cwdb/dnsinfo
1 compromised version
- Jun 20, 2022
Malware in bob-app-core
1 compromised version
- Jun 20, 2022
Malware in theme_dbtraining
1 compromised version
- Jun 20, 2022
Malware in testingtesttencencent
1 compromised version
- Jun 20, 2022
Malicious code in huobi-trading-view (npm)
- Jun 20, 2022
Malicious code in hb-websocket-client (npm)
- Jun 20, 2022
Malicious code in hb-portal-xss (npm)
- Jun 20, 2022
Malicious code in hb-analytics-js-sdk (npm)
- Jun 20, 2022
Malware in hb-analytics-js-sdk
1 compromised version
- Jun 20, 2022
Malware in huobi-trading-view
1 compromised version
- Jun 20, 2022
Malware in hb-websocket-client
1 compromised version
- Jun 20, 2022
Malware in hb-portal-xss
1 compromised version
- Jun 20, 2022
Malicious code in huobi-trading-view-swap (npm)
- Jun 20, 2022
Malicious code in huobi-bs-fe-scaffold (npm)
- Jun 20, 2022
Malicious code in huobi-bigmac-component (npm)
- Jun 20, 2022
Malicious code in fed-cnr-pagelet (npm)
- Jun 20, 2022
Malware in huobi-bs-fe-scaffold
1 compromised version
- Jun 20, 2022
Malware in huobi-bigmac-component
1 compromised version
- Jun 20, 2022
Malware in huobi-trading-view-swap
1 compromised version
- Jun 20, 2022
Malware in fed-cnr-pagelet
1 compromised version
- Jun 20, 2022
Malicious code in pwn_module (npm)
- Jun 20, 2022
Malicious code in login.mail.ru (npm)
- Jun 20, 2022
Malicious code in lenta_pulse_mail_ru_internal (npm)
- Jun 20, 2022
Malicious code in lenta_pulse_mail_ru (npm)
- Jun 20, 2022
Malicious code in @is24at/react-tracking (npm)
1 compromised version
- Jun 20, 2022
Malware in lenta_pulse_mail_ru_internal
1 compromised version
Page 7100 of 7,293