Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in pingheretoo
1 compromised version
- Jun 20, 2022
Malware in here-paypal
1 compromised version
- Jun 20, 2022
Malicious code in testfromauro (npm)
- Jun 20, 2022
Malicious code in status-paypal (npm)
- Jun 20, 2022
Malicious code in prepaid-paypal (npm)
- Jun 20, 2022
Malicious code in corp-paypal (npm)
- Jun 20, 2022
Malicious code in community-paypal (npm)
- Jun 20, 2022
Malware in prepaid-paypal
1 compromised version
- Jun 20, 2022
Malware in community-paypal
1 compromised version
- Jun 20, 2022
Malware in testfromauro
1 compromised version
- Jun 20, 2022
Malware in status-paypal
1 compromised version
- Jun 20, 2022
Malware in corp-paypal
1 compromised version
- Jun 20, 2022
Malicious code in @tekion/test (npm)
- Jun 20, 2022
Malicious code in @tekion/fxt (npm)
- Jun 20, 2022
Malicious code in com.unity.postprocessing (npm)
- Jun 20, 2022
Malicious code in com.google.firebase.app (npm)
- Jun 20, 2022
Malware in com.google.firebase.app
1 compromised version
- Jun 20, 2022
Malware in @tekion/fxt
1 compromised version
- Jun 20, 2022
Malware in @tekion/test
1 compromised version
- Jun 20, 2022
Malware in com.unity.postprocessing
1 compromised version
- Jun 20, 2022
Malicious code in @tekion/kxt (npm)
- Jun 20, 2022
Malicious code in @tekion/gamma (npm)
- Jun 20, 2022
Malicious code in @tekion/beta (npm)
- Jun 20, 2022
Malicious code in @tekion/alpha (npm)
- Jun 20, 2022
Malware in @tekion/alpha
1 compromised version
- Jun 20, 2022
Malware in @tekion/kxt
1 compromised version
- Jun 20, 2022
Malware in @tekion/beta
1 compromised version
- Jun 20, 2022
Malware in @tekion/gamma
1 compromised version
- Jun 20, 2022
Malicious code in trinity-pkg-ss (npm)
- Jun 20, 2022
Malicious code in shakt-pkg-ss (npm)
- Jun 20, 2022
Malicious code in puppetlabs-stdlib (npm)
- Jun 20, 2022
Malicious code in hacked-shakti (npm)
- Jun 20, 2022
Malware in puppetlabs-stdlib
1 compromised version
- Jun 20, 2022
Malware in shakt-pkg-ss
1 compromised version
- Jun 20, 2022
Malware in hacked-shakti
1 compromised version
- Jun 20, 2022
Malware in trinity-pkg-ss
1 compromised version
- Jun 20, 2022
Malicious code in internal_pk_for_ss (npm)
- Jun 20, 2022
Malicious code in 13-pkg-14 (npm)
- Jun 20, 2022
Malicious code in 13-pkg-1313 (npm)
- Jun 20, 2022
Malicious code in 13-pkg-13 (npm)
- Jun 20, 2022
Malware in 13-pkg-1313
1 compromised version
- Jun 20, 2022
Malware in 13-pkg-14
1 compromised version
- Jun 20, 2022
Malware in 13-pkg-13
1 compromised version
- Jun 20, 2022
Malware in internal_pk_for_ss
1 compromised version
- Jun 20, 2022
Malicious code in shakti_saan_sai755 (npm)
- Jun 20, 2022
Malicious code in sai_package_755 (npm)
- Jun 20, 2022
Malicious code in package_avvo_dep (npm)
- Jun 20, 2022
Malicious code in internal_pkg_for_755 (npm)
- Jun 20, 2022
Malware in sai_package_755
1 compromised version
- Jun 20, 2022
Malware in package_avvo_dep
1 compromised version
Page 7119 of 7,293