Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malicious code in twitter-new (npm)
- Jun 20, 2022
Malicious code in payments-reference-app (npm)
- Jun 20, 2022
Malicious code in cadence-docs (npm)
- Jun 20, 2022
Malicious code in blockswithscreens (npm)
- Jun 20, 2022
Malware in blockswithscreens
1 compromised version
- Jun 20, 2022
Malware in payments-reference-app
1 compromised version
- Jun 20, 2022
Malware in twitter-new
1 compromised version
- Jun 20, 2022
Malware in cadence-docs
1 compromised version
- Jun 20, 2022
Malicious code in webhint-configuration-braintree-sdk (npm)
- Jun 20, 2022
Malicious code in h3-website (npm)
- Jun 20, 2022
Malicious code in fbt-top-level-repo (npm)
- Jun 20, 2022
Malicious code in checkout-docs (npm)
- Jun 20, 2022
Malware in checkout-docs
1 compromised version
- Jun 20, 2022
Malware in h3-website
1 compromised version
- Jun 20, 2022
Malware in fbt-top-level-repo
1 compromised version
- Jun 20, 2022
Malware in webhint-configuration-braintree-sdk
1 compromised version
- Jun 20, 2022
Malicious code in @boosted-bounty/worker-helpers (npm)
- Jun 20, 2022
Malicious code in @boosted-bounty/firebase-helpers-js (npm)
- Jun 20, 2022
Malicious code in @boosted-bounty/firebase-helpers (npm)
- Jun 20, 2022
Malicious code in @boosted-bounty/backend-interfaces (npm)
- Jun 20, 2022
Malware in @boosted-bounty/worker-helpers
1 compromised version
- Jun 20, 2022
Malware in @boosted-bounty/firebase-helpers
1 compromised version
- Jun 20, 2022
Malware in @boosted-bounty/backend-interfaces
1 compromised version
- Jun 20, 2022
Malware in @boosted-bounty/firebase-helpers-js
1 compromised version
- Jun 20, 2022
Malicious code in yelp_styleguide (npm)
- Jun 20, 2022
Malicious code in yelp_js_alert (npm)
- Jun 20, 2022
Malicious code in @boosted-bounty/firebase-queue (npm)
- Jun 20, 2022
Malicious code in @boosted-bounty/cassandra-helpers (npm)
- Jun 20, 2022
Malware in yelp_styleguide
1 compromised version
- Jun 20, 2022
Malware in @boosted-bounty/firebase-queue
1 compromised version
- Jun 20, 2022
Malware in @boosted-bounty/cassandra-helpers
1 compromised version
- Jun 20, 2022
Malware in yelp_js_alert
1 compromised version
- Jun 20, 2022
Malicious code in yelp_map_engine (npm)
- Jun 20, 2022
Malicious code in yelp_js_component (npm)
- Jun 20, 2022
Malicious code in koop-componentenbibliotheek (npm)
- Jun 20, 2022
Malicious code in kaartprikmodule (npm)
- Jun 20, 2022
Malware in yelp_js_component
1 compromised version
- Jun 20, 2022
Malware in kaartprikmodule
1 compromised version
- Jun 20, 2022
Malware in yelp_map_engine
1 compromised version
- Jun 20, 2022
Malware in koop-componentenbibliotheek
1 compromised version
- Jun 20, 2022
Malicious code in this-is-a-special-123 (npm)
- Jun 20, 2022
Malicious code in proton-super-package (npm)
- Jun 20, 2022
Malicious code in mynewpkgtest1 (npm)
- Jun 20, 2022
Malicious code in mynewpkgtest (npm)
- Jun 20, 2022
Malicious code in hs-inflamable-too (npm)
- Jun 20, 2022
Malware in hs-inflamable-too
1 compromised version
- Jun 20, 2022
Malware in proton-super-package
1 compromised version
- Jun 20, 2022
Malware in mynewpkgtest1
1 compromised version
- Jun 20, 2022
Malware in this-is-a-special-123
1 compromised version
- Jun 20, 2022
Malware in mynewpkgtest
1 compromised version
Page 7104 of 7,293