Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in prod-package
1 compromised version
- Jun 20, 2022
Malware in eks-auto-create-idp
1 compromised version
- Jun 20, 2022
Malware in unified-instantsearch-ecommerce
1 compromised version
- Jun 20, 2022
Malware in persona-verifier-lib
1 compromised version
- Jun 20, 2022
Malicious code in shopify-utils (npm)
- Jun 20, 2022
Malicious code in shopify-tutorial (npm)
- Jun 20, 2022
Malicious code in shopify-proxy (npm)
- Jun 20, 2022
Malicious code in shopify-demo (npm)
- Jun 20, 2022
Malware in shopify-tutorial
1 compromised version
- Jun 20, 2022
Malware in shopify-utils
1 compromised version
- Jun 20, 2022
Malware in shopify-demo
1 compromised version
- Jun 20, 2022
Malware in shopify-proxy
1 compromised version
- Jun 20, 2022
Malicious code in shopify-ewrjknfd (npm)
- Jun 20, 2022
Malicious code in meta-left-pad (npm)
- Jun 20, 2022
Malicious code in @gco-angular/rxjs-utils (npm)
- Jun 20, 2022
Malicious code in @gco-angular/communication-facade (npm)
- Jun 20, 2022
Malware in meta-left-pad
1 compromised version
- Jun 20, 2022
Malware in @gco-angular/communication-facade
1 compromised version
- Jun 20, 2022
Malware in shopify-ewrjknfd
1 compromised version
- Jun 20, 2022
Malware in @gco-angular/rxjs-utils
1 compromised version
- Jun 20, 2022
Malicious code in @gs-ux-uitoolkit-react/theme (npm)
- Jun 20, 2022
Malicious code in @gs-ux-uitoolkit-react/shared (npm)
- Jun 20, 2022
Malicious code in @gco-angular/apollo (npm)
- Jun 20, 2022
Malware in @gs-ux-uitoolkit-react/theme
1 compromised version
- Jun 20, 2022
Malware in @gs-ux-uitoolkit-react/shared
1 compromised version
- Jun 20, 2022
Malware in @gco-angular/apollo
1 compromised version
- Jun 20, 2022
Malicious code in @umpirsky/country-list (npm)
- Jun 20, 2022
Malicious code in @gs-ux-uitoolkit-react/select (npm)
- Jun 20, 2022
Malicious code in @gs-ux-uitoolkit-react/core (npm)
- Jun 20, 2022
Malicious code in epc-web-utils (npm)
- Jun 20, 2022
Malware in epc-web-utils
1 compromised version
- Jun 20, 2022
Malware in @gs-ux-uitoolkit-react/core
1 compromised version
- Jun 20, 2022
Malware in @umpirsky/country-list
1 compromised version
- Jun 20, 2022
Malware in @gs-ux-uitoolkit-react/select
1 compromised version
- Jun 20, 2022
Malicious code in golf-to-eid (npm)
- Jun 20, 2022
Malicious code in fe-grid (npm)
- Jun 20, 2022
Malicious code in dn-dev-env (npm)
- Jun 20, 2022
Malicious code in bls12377js (npm)
- Jun 20, 2022
Malware in bls12377js
1 compromised version
- Jun 20, 2022
Malware in dn-dev-env
1 compromised version
- Jun 20, 2022
Malware in fe-grid
1 compromised version
- Jun 20, 2022
Malware in golf-to-eid
1 compromised version
- Jun 20, 2022
Malicious code in sb-resp-ui (npm)
- Jun 20, 2022
Malicious code in sb-legacy-integration (npm)
- Jun 20, 2022
Malicious code in sb-helpers (npm)
- Jun 20, 2022
Malicious code in runkit-embed (npm)
- Jun 20, 2022
Malicious code in react-fe-bootstrap (npm)
- Jun 20, 2022
Malware in sb-legacy-integration
1 compromised version
- Jun 20, 2022
Malware in runkit-embed
1 compromised version
- Jun 20, 2022
Malware in react-fe-bootstrap
1 compromised version
Page 7109 of 7,293