Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malicious code in usaa-banner (npm)
- Jun 20, 2022
Malicious code in usaa-axios-factory (npm)
- Jun 20, 2022
Malicious code in usaa-authentication (npm)
- Jun 20, 2022
Malware in usaa-banner
1 compromised version
- Jun 20, 2022
Malware in usaa-authentication
1 compromised version
- Jun 20, 2022
Malware in usaa-axios-factory
1 compromised version
- Jun 20, 2022
Malicious code in yras (npm)
- Jun 20, 2022
Malicious code in trello-canonical-components (npm)
- Jun 20, 2022
Malicious code in gopro-web-react-components (npm)
- Jun 20, 2022
Malicious code in gopro-web-javascript-components (npm)
- Jun 20, 2022
Malware in gopro-web-javascript-components
1 compromised version
- Jun 20, 2022
Malware in gopro-web-react-components
1 compromised version
- Jun 20, 2022
Malware in yras
1 compromised version
- Jun 20, 2022
Malware in trello-canonical-components
1 compromised version
- Jun 20, 2022
Malicious code in yhps (npm)
- Jun 20, 2022
Malicious code in viewportpriorityadjuster (npm)
- Jun 20, 2022
Malicious code in videostreamingtaskqueueprovider (npm)
- Jun 20, 2022
Malicious code in videostreamingmanager (npm)
- Jun 20, 2022
Malware in yhps
1 compromised version
- Jun 20, 2022
Malware in viewportpriorityadjuster
1 compromised version
- Jun 20, 2022
Malware in videostreamingmanager
1 compromised version
- Jun 20, 2022
Malware in videostreamingtaskqueueprovider
1 compromised version
- Jun 20, 2022
Malicious code in videoprioritycalculator (npm)
- Jun 20, 2022
Malicious code in videoplayershakaperformancelogger (npm)
- Jun 20, 2022
Malicious code in videoplayershakaglobalconfig (npm)
- Jun 20, 2022
Malicious code in videoplayerresourcetimer (npm)
- Jun 20, 2022
Malware in videoprioritycalculator
1 compromised version
- Jun 20, 2022
Malware in videoplayershakaperformancelogger
1 compromised version
- Jun 20, 2022
Malware in videoplayerresourcetimer
1 compromised version
- Jun 20, 2022
Malware in videoplayershakaglobalconfig
1 compromised version
- Jun 20, 2022
Malicious code in videoplayerlocalbandwidthestimator (npm)
- Jun 20, 2022
Malicious code in videoplayerbitrateestimator (npm)
- Jun 20, 2022
Malicious code in videodashprefetchcache (npm)
- Jun 20, 2022
Malicious code in videoclientedgecooperation (npm)
- Jun 20, 2022
Malware in videoplayerbitrateestimator
1 compromised version
- Jun 20, 2022
Malware in videoclientedgecooperation
1 compromised version
- Jun 20, 2022
Malware in videoplayerlocalbandwidthestimator
1 compromised version
- Jun 20, 2022
Malware in videodashprefetchcache
1 compromised version
- Jun 20, 2022
Malicious code in unitconstants (npm)
- Jun 20, 2022
Malicious code in tcfm (npm)
- Jun 20, 2022
Malicious code in setimmediateacrosstransitions (npm)
- Jun 20, 2022
Malicious code in serverjsdefine (npm)
- Jun 20, 2022
Malicious code in init-epic-link-multiselect (npm)
- Jun 20, 2022
Malware in setimmediateacrosstransitions
1 compromised version
- Jun 20, 2022
Malware in unitconstants
1 compromised version
- Jun 20, 2022
Malware in serverjsdefine
1 compromised version
- Jun 20, 2022
Malware in tcfm
1 compromised version
- Jun 20, 2022
Malware in init-epic-link-multiselect
1 compromised version
- Jun 20, 2022
Malicious code in segmentrequestmanager (npm)
- Jun 20, 2022
Malicious code in networkstatusdetector (npm)
Page 7115 of 7,293