Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malicious code in bunny-v2 (npm)
- Jun 20, 2022
Malicious code in beefy-vote (npm)
- Jun 20, 2022
Malware in beefy-vote
1 compromised version
- Jun 20, 2022
Malware in @cornershop/core
1 compromised version
- Jun 20, 2022
Malware in union-finance-contracts
1 compromised version
- Jun 20, 2022
Malware in bunny-v2
1 compromised version
- Jun 20, 2022
Malicious code in @tinyspeck/calls-desktop-interop (npm)
- Jun 20, 2022
Malicious code in shub-service (npm)
- Jun 20, 2022
Malicious code in media-hid (npm)
- Jun 20, 2022
Malicious code in @dedatre/xptopkg (npm)
- Jun 20, 2022
Malware in @dedatre/xptopkg
1 compromised version
- Jun 20, 2022
Malware in media-hid
1 compromised version
- Jun 20, 2022
Malware in @tinyspeck/calls-desktop-interop
1 compromised version
- Jun 20, 2022
Malware in shub-service
1 compromised version
- Jun 20, 2022
Malicious code in telem (npm)
- Jun 20, 2022
Malicious code in teams-outlook-meeting-addin (npm)
- Jun 20, 2022
Malicious code in slimcore (npm)
- Jun 20, 2022
Malicious code in cm-integration (npm)
- Jun 20, 2022
Malware in telem
1 compromised version
- Jun 20, 2022
Malware in cm-integration
1 compromised version
- Jun 20, 2022
Malware in teams-outlook-meeting-addin
1 compromised version
- Jun 20, 2022
Malware in slimcore
1 compromised version
- Jun 20, 2022
Malicious code in redox-sample-nodejs (npm)
- Jun 20, 2022
Malicious code in ov-api (npm)
- Jun 20, 2022
Malicious code in exodus-update-server (npm)
- Jun 20, 2022
Malicious code in cryptolib-js (npm)
- Jun 20, 2022
Malware in cryptolib-js
1 compromised version
- Jun 20, 2022
Malware in ov-api
1 compromised version
- Jun 20, 2022
Malware in exodus-update-server
1 compromised version
- Jun 20, 2022
Malware in redox-sample-nodejs
1 compromised version
- Jun 20, 2022
Malicious code in zapper-safe-app (npm)
- Jun 20, 2022
Malicious code in rnwasmtest (npm)
- Jun 20, 2022
Malicious code in grpc-web-ruby (npm)
- Jun 20, 2022
Malicious code in audit-pricing (npm)
- Jun 20, 2022
Malware in zapper-safe-app
1 compromised version
- Jun 20, 2022
Malware in audit-pricing
1 compromised version
- Jun 20, 2022
Malware in rnwasmtest
1 compromised version
- Jun 20, 2022
Malware in grpc-web-ruby
1 compromised version
- Jun 20, 2022
Malicious code in zapper-api-stack (npm)
- Jun 20, 2022
Malicious code in sushiswap-shiny-frontend (npm)
- Jun 20, 2022
Malicious code in sovryn-node-integration-tests (npm)
- Jun 20, 2022
Malicious code in monday-integration-quickstart-app (npm)
- Jun 20, 2022
Malicious code in enzyme-kovan (npm)
- Jun 20, 2022
Malware in sushiswap-shiny-frontend
1 compromised version
- Jun 20, 2022
Malware in zapper-api-stack
1 compromised version
- Jun 20, 2022
Malware in enzyme-kovan
1 compromised version
- Jun 20, 2022
Malware in sovryn-node-integration-tests
1 compromised version
- Jun 20, 2022
Malware in monday-integration-quickstart-app
1 compromised version
- Jun 20, 2022
Malicious code in @aia-digital/request-module (npm)
- Jun 20, 2022
Malicious code in fei-protocol-core (npm)
Page 7122 of 7,293