Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in p4clients
1 compromised version
- Jun 20, 2022
Malware in uv-dlopen
1 compromised version
- Jun 20, 2022
Malicious code in xml-service (npm)
- Jun 20, 2022
Malicious code in headerprefix (npm)
- Jun 20, 2022
Malicious code in generator-electron-dotnet (npm)
- Jun 20, 2022
Malware in generator-electron-dotnet
1 compromised version
- Jun 20, 2022
Malware in xml-service
1 compromised version
- Jun 20, 2022
Malware in headerprefix
1 compromised version
- Jun 20, 2022
Malicious code in additional-properties (npm)
- Jun 20, 2022
Malicious code in odata-discriminator (npm)
- Jun 20, 2022
Malicious code in network-resource-manager (npm)
- Jun 20, 2022
Malicious code in body-complex-rest (npm)
- Jun 20, 2022
Malware in network-resource-manager
1 compromised version
- Jun 20, 2022
Malware in odata-discriminator
1 compromised version
- Jun 20, 2022
Malware in additional-properties
1 compromised version
- Jun 20, 2022
Malware in body-complex-rest
1 compromised version
- Jun 20, 2022
Malicious code in xms-error-responses (npm)
- Jun 20, 2022
Malicious code in useragent-corev2 (npm)
- Jun 20, 2022
Malicious code in url-multi (npm)
- Jun 20, 2022
Malicious code in subscriptionid-apiversion (npm)
- Jun 20, 2022
Malware in subscriptionid-apiversion
1 compromised version
- Jun 20, 2022
Malware in url-multi
1 compromised version
- Jun 20, 2022
Malware in xms-error-responses
1 compromised version
- Jun 20, 2022
Malware in useragent-corev2
1 compromised version
- Jun 20, 2022
Malicious code in zzzreport (npm)
- Jun 20, 2022
Malicious code in storageblob (npm)
- Jun 20, 2022
Malicious code in required-optional (npm)
- Jun 20, 2022
Malicious code in regex-constraint (npm)
- Jun 20, 2022
Malware in regex-constraint
1 compromised version
- Jun 20, 2022
Malware in storageblob
1 compromised version
- Jun 20, 2022
Malware in required-optional
1 compromised version
- Jun 20, 2022
Malware in zzzreport
1 compromised version
- Jun 20, 2022
Malicious code in paging-service (npm)
- Jun 20, 2022
Malicious code in paging-no-iterators (npm)
- Jun 20, 2022
Malicious code in optionalnull (npm)
- Jun 20, 2022
Malicious code in operationgroupclash (npm)
- Jun 20, 2022
Malicious code in non-string-num (npm)
- Jun 20, 2022
Malicious code in no-mappers (npm)
- Jun 20, 2022
Malware in no-mappers
1 compromised version
- Jun 20, 2022
Malware in optionalnull
1 compromised version
- Jun 20, 2022
Malware in operationgroupclash
1 compromised version
- Jun 20, 2022
Malware in non-string-num
1 compromised version
- Jun 20, 2022
Malware in paging-service
1 compromised version
- Jun 20, 2022
Malware in paging-no-iterators
1 compromised version
- Jun 20, 2022
Malicious code in nolicense-header (npm)
- Jun 20, 2022
Malicious code in model-flattening (npm)
- Jun 20, 2022
Malicious code in media-types-service-tracing (npm)
- Jun 20, 2022
Malware in nolicense-header
1 compromised version
- Jun 20, 2022
Malware in media-types-service-tracing
1 compromised version
- Jun 20, 2022
Malware in model-flattening
1 compromised version
Page 7112 of 7,293