Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in researchgate
1 compromised version
- Jun 20, 2022
Malware in ledgerhq
1 compromised version
- Jun 20, 2022
Malicious code in admin-tribe (npm)
- Jun 20, 2022
Malicious code in rafaelgg44 (npm)
- Jun 20, 2022
Malicious code in phensley (npm)
- Jun 20, 2022
Malicious code in mt-react-theme-manager (npm)
- Jun 20, 2022
Malicious code in avito (npm)
- Jun 20, 2022
Malware in rafaelgg44
1 compromised version
- Jun 20, 2022
Malware in mt-react-theme-manager
1 compromised version
- Jun 20, 2022
Malware in avito
1 compromised version
- Jun 20, 2022
Malware in phensley
1 compromised version
- Jun 20, 2022
Malware in admin-tribe
1 compromised version
- Jun 20, 2022
Malicious code in ramp-network (npm)
- Jun 20, 2022
Malicious code in npm-test-bravol33 (npm)
- Jun 20, 2022
Malicious code in fortawesome (npm)
- Jun 20, 2022
Malicious code in arkane-network (npm)
- Jun 20, 2022
Malware in ramp-network
1 compromised version
- Jun 20, 2022
Malware in arkane-network
1 compromised version
- Jun 20, 2022
Malware in npm-test-bravol33
1 compromised version
- Jun 20, 2022
Malware in fortawesome
1 compromised version
- Jun 20, 2022
Malicious code in paypal-sdk-e2e-tests (npm)
- Jun 20, 2022
Malicious code in lint-config-qiwi (npm)
- Jun 20, 2022
Malicious code in infectplugin (npm)
- Jun 20, 2022
Malicious code in esprimere (npm)
- Jun 20, 2022
Malware in infectplugin
1 compromised version
- Jun 20, 2022
Malware in paypal-sdk-e2e-tests
1 compromised version
- Jun 20, 2022
Malware in esprimere
1 compromised version
- Jun 20, 2022
Malware in lint-config-qiwi
1 compromised version
- Jun 20, 2022
Malicious code in xo-shim-promise (npm)
- Jun 20, 2022
Malicious code in xo-hermes-checkout (npm)
- Jun 20, 2022
Malicious code in idnnnms-widget-auth-service (npm)
- Jun 20, 2022
Malicious code in app-shims (npm)
- Jun 20, 2022
Malware in idnnnms-widget-auth-service
1 compromised version
- Jun 20, 2022
Malware in xo-hermes-checkout
1 compromised version
- Jun 20, 2022
Malware in app-shims
1 compromised version
- Jun 20, 2022
Malware in xo-shim-promise
1 compromised version
- Jun 20, 2022
Malicious code in yelp_template (npm)
- Jun 20, 2022
Malicious code in react-paypal-js (npm)
- Jun 20, 2022
Malicious code in idmsa (npm)
- Jun 20, 2022
Malicious code in corp_template (npm)
- Jun 20, 2022
Malicious code in clusterman-metrics (npm)
- Jun 20, 2022
Malware in clusterman-metrics
1 compromised version
- Jun 20, 2022
Malware in corp_template
1 compromised version
- Jun 20, 2022
Malware in yelp_template
1 compromised version
- Jun 20, 2022
Malware in idmsa
1 compromised version
- Jun 20, 2022
Malware in react-paypal-js
1 compromised version
- Jun 20, 2022
Malicious code in pypl (npm)
- Jun 20, 2022
Malicious code in pingheretoo (npm)
- Jun 20, 2022
Malicious code in here-paypal (npm)
- Jun 20, 2022
Malware in pypl
1 compromised version
Page 7118 of 7,293