Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in apex-web-tools
1 compromised version
- Jun 20, 2022
Malware in base-css-styles
1 compromised version
- Jun 20, 2022
Malicious code in corewebclient (npm)
- Jun 20, 2022
Malicious code in common-tasks (npm)
- Jun 20, 2022
Malicious code in cm.icons (npm)
- Jun 20, 2022
Malicious code in cloudfour.com-patterns (npm)
- Jun 20, 2022
Malware in corewebclient
1 compromised version
- Jun 20, 2022
Malware in common-tasks
1 compromised version
- Jun 20, 2022
Malware in cloudfour.com-patterns
1 compromised version
- Jun 20, 2022
Malware in cm.icons
1 compromised version
- Jun 20, 2022
Malicious code in flotchart (npm)
- Jun 20, 2022
Malicious code in eslint-config-rol (npm)
- Jun 20, 2022
Malicious code in eslint-config-products (npm)
- Jun 20, 2022
Malicious code in enviso-web-components-common (npm)
- Jun 20, 2022
Malware in eslint-config-rol
1 compromised version
- Jun 20, 2022
Malware in enviso-web-components-common
1 compromised version
- Jun 20, 2022
Malware in flotchart
1 compromised version
- Jun 20, 2022
Malware in eslint-config-products
1 compromised version
- Jun 20, 2022
Malicious code in wordpress-core-css (npm)
- Jun 20, 2022
Malicious code in studiolabs-cli (npm)
- Jun 20, 2022
Malicious code in @moczadlo/package_one (npm)
- Jun 20, 2022
Malicious code in grunt-via-filesystem (npm)
- Jun 20, 2022
Malware in @moczadlo/package_one
1 compromised version
- Jun 20, 2022
Malware in grunt-via-filesystem
1 compromised version
- Jun 20, 2022
Malware in studiolabs-cli
1 compromised version
- Jun 20, 2022
Malware in wordpress-core-css
1 compromised version
- Jun 20, 2022
Malicious code in publicrepoui (npm)
- Jun 20, 2022
Malicious code in github-brand (npm)
- Jun 20, 2022
Malicious code in ford-cpo-v3-packaging (npm)
- Jun 20, 2022
Malicious code in energy-phoenix-core-auth (npm)
- Jun 20, 2022
Malicious code in ayalon-demo-website-frontend (npm)
- Jun 20, 2022
Malware in publicrepoui
1 compromised version
- Jun 20, 2022
Malware in ayalon-demo-website-frontend
1 compromised version
- Jun 20, 2022
Malware in github-brand
1 compromised version
- Jun 20, 2022
Malware in energy-phoenix-core-auth
1 compromised version
- Jun 20, 2022
Malware in ford-cpo-v3-packaging
1 compromised version
- Jun 20, 2022
Malicious code in microsites-ui-hudsons-bay-french (npm)
- Jun 20, 2022
Malicious code in customer-stories-feed (npm)
- Jun 20, 2022
Malicious code in click-out-report-website (npm)
- Jun 20, 2022
Malware in microsites-ui-hudsons-bay-french
1 compromised version
- Jun 20, 2022
Malware in click-out-report-website
1 compromised version
- Jun 20, 2022
Malware in customer-stories-feed
1 compromised version
- Jun 20, 2022
Malicious code in trip-tracker-web (npm)
- Jun 20, 2022
Malicious code in training-kit (npm)
- Jun 20, 2022
Malicious code in oro-gulp (npm)
- Jun 20, 2022
Malicious code in health-bot-onboarding-client (npm)
- Jun 20, 2022
Malicious code in giphy-web-app (npm)
- Jun 20, 2022
Malware in health-bot-onboarding-client
1 compromised version
- Jun 20, 2022
Malware in trip-tracker-web
1 compromised version
- Jun 20, 2022
Malware in giphy-web-app
1 compromised version
Page 7102 of 7,293