Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in training-kit
1 compromised version
- Jun 20, 2022
Malware in oro-gulp
1 compromised version
- Jun 20, 2022
Malicious code in @koop-components/common (npm)
- Jun 20, 2022
Malicious code in fluxible-repo (npm)
- Jun 20, 2022
Malicious code in fetchr-simple-example (npm)
- Jun 20, 2022
Malicious code in badge-up-api (npm)
- Jun 20, 2022
Malware in @koop-components/common
1 compromised version
- Jun 20, 2022
Malware in fluxible-repo
1 compromised version
- Jun 20, 2022
Malware in fetchr-simple-example
1 compromised version
- Jun 20, 2022
Malware in badge-up-api
1 compromised version
- Jun 20, 2022
Malicious code in grab-login (npm)
- Jun 20, 2022
Malicious code in grab-locale (npm)
- Jun 20, 2022
Malicious code in evil-testing (npm)
- Jun 20, 2022
Malicious code in evil-test-1 (npm)
- Jun 20, 2022
Malware in grab-locale
1 compromised version
- Jun 20, 2022
Malware in evil-test-1
1 compromised version
- Jun 20, 2022
Malware in grab-login
1 compromised version
- Jun 20, 2022
Malware in evil-testing
1 compromised version
- Jun 20, 2022
Malicious code in @nerv-hq/control-system (npm)
- Jun 20, 2022
Malicious code in grab-ui (npm)
- Jun 20, 2022
Malicious code in grab-storage (npm)
- Jun 20, 2022
Malicious code in elide-doc (npm)
- Jun 20, 2022
Malware in grab-ui
1 compromised version
- Jun 20, 2022
Malware in grab-storage
1 compromised version
- Jun 20, 2022
Malware in @nerv-hq/control-system
1 compromised version
- Jun 20, 2022
Malware in elide-doc
1 compromised version
- Jun 20, 2022
Malicious code in rippled-exporter (npm)
- Jun 20, 2022
Malicious code in parity-exporter (npm)
- Jun 20, 2022
Malicious code in block-utxos (npm)
- Jun 20, 2022
Malware in block-utxos
1 compromised version
- Jun 20, 2022
Malware in parity-exporter
1 compromised version
- Jun 20, 2022
Malware in rippled-exporter
1 compromised version
- Jun 20, 2022
Malicious code in nim-status-client (npm)
- Jun 20, 2022
Malicious code in mattermost-webapp (npm)
- Jun 20, 2022
Malicious code in eslint-plugin-mattermost (npm)
- Jun 20, 2022
Malicious code in dynamic-virtualized-list (npm)
- Jun 20, 2022
Malware in nim-status-client
1 compromised version
- Jun 20, 2022
Malware in mattermost-webapp
1 compromised version
- Jun 20, 2022
Malware in dynamic-virtualized-list
1 compromised version
- Jun 20, 2022
Malware in eslint-plugin-mattermost
1 compromised version
- Jun 20, 2022
Malicious code in translationscripts (npm)
- Jun 20, 2022
Malicious code in paytm-mini-programs-nodejs-sdk (npm)
- Jun 20, 2022
Malicious code in paytm-blink-checkout-react-example (npm)
- Jun 20, 2022
Malicious code in matomo-analytics-cloudflare-app (npm)
- Jun 20, 2022
Malicious code in github-issue-mirror (npm)
- Jun 20, 2022
Malware in github-issue-mirror
1 compromised version
- Jun 20, 2022
Malware in paytm-blink-checkout-react-example
1 compromised version
- Jun 20, 2022
Malware in translationscripts
1 compromised version
- Jun 20, 2022
Malware in matomo-analytics-cloudflare-app
1 compromised version
- Jun 20, 2022
Malware in paytm-mini-programs-nodejs-sdk
1 compromised version
Page 7103 of 7,293