Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in ember-tracked-local-storag
1 compromised version
- Jun 20, 2022
Malware in singhaditi12
1 compromised version
- Jun 20, 2022
Malware in nt-shared
1 compromised version
- Jun 20, 2022
Malware in discord.js-selfbot-updated
1 compromised version
- Jun 20, 2022
Malicious code in aditi1123 (npm)
- Jun 20, 2022
Malicious code in aditi112 (npm)
- Jun 20, 2022
Malicious code in singhadi1222 (npm)
- Jun 20, 2022
Malicious code in daemon121 (npm)
- Jun 20, 2022
Malware in singhadi1222
1 compromised version
- Jun 20, 2022
Malware in daemon121
1 compromised version
- Jun 20, 2022
Malware in aditi1123
1 compromised version
- Jun 20, 2022
Malware in aditi112
1 compromised version
- Jun 20, 2022
Malicious code in singhaditi83683 (npm)
- Jun 20, 2022
Malicious code in singhaditi2707 (npm)
- Jun 20, 2022
Malicious code in build-python12 (npm)
- Jun 20, 2022
Malicious code in build-python (npm)
- Jun 20, 2022
Malware in singhaditi83683
1 compromised version
- Jun 20, 2022
Malware in build-python
1 compromised version
- Jun 20, 2022
Malware in singhaditi2707
1 compromised version
- Jun 20, 2022
Malware in build-python12
1 compromised version
- Jun 20, 2022
Malicious code in adbuil (npm)
- Jun 20, 2022
Malicious code in ad1231 (npm)
- Jun 20, 2022
Malicious code in ad1213 (npm)
- Jun 20, 2022
Malicious code in buildaditi (npm)
- Jun 20, 2022
Malware in adbuil
1 compromised version
- Jun 20, 2022
Malware in ad1231
1 compromised version
- Jun 20, 2022
Malware in buildaditi
1 compromised version
- Jun 20, 2022
Malware in ad1213
1 compromised version
- Jun 20, 2022
Malicious code in token-unit-es5 (npm)
- Jun 20, 2022
Malicious code in testnpmad12 (npm)
- Jun 20, 2022
Malicious code in testnpmad (npm)
- Jun 20, 2022
Malicious code in testad123 (npm)
- Jun 20, 2022
Malicious code in ng-browser-info (npm)
- Jun 20, 2022
Malware in testnpmad
1 compromised version
- Jun 20, 2022
Malware in testad123
1 compromised version
- Jun 20, 2022
Malware in testnpmad12
1 compromised version
- Jun 20, 2022
Malware in token-unit-es5
1 compromised version
- Jun 20, 2022
Malware in ng-browser-info
1 compromised version
- Jun 20, 2022
Malicious code in socless_integration_packager (npm)
- Jun 20, 2022
Malicious code in eslint-config-vmware-react (npm)
- Jun 20, 2022
Malicious code in bluejeans-api-rest-meetings (npm)
- Jun 20, 2022
Malware in bluejeans-api-rest-meetings
1 compromised version
- Jun 20, 2022
Malware in eslint-config-vmware-react
1 compromised version
- Jun 20, 2022
Malware in socless_integration_packager
1 compromised version
- Jun 20, 2022
Malicious code in unified-instantsearch-ecommerce (npm)
- Jun 20, 2022
Malicious code in prod-package (npm)
- Jun 20, 2022
Malicious code in persona-verifier-lib (npm)
- Jun 20, 2022
Malicious code in node-upwork-oauth2 (npm)
- Jun 20, 2022
Malicious code in eks-auto-create-idp (npm)
- Jun 20, 2022
Malware in node-upwork-oauth2
1 compromised version
Page 7108 of 7,293