Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malicious code in 2key-metrics (npm)
- Jun 20, 2022
Malicious code in apswap-api (npm)
- Jun 20, 2022
Malware in 2key-metrics
1 compromised version
- Jun 20, 2022
Malware in fei-protocol-core
1 compromised version
- Jun 20, 2022
Malware in @aia-digital/request-module
1 compromised version
- Jun 20, 2022
Malware in apswap-api
1 compromised version
- Jun 20, 2022
Malicious code in @worki/lib-web-common (npm)
- Jun 20, 2022
Malicious code in @aia-digital/ui-library (npm)
- Jun 20, 2022
Malicious code in js_packages_security_test (npm)
- Jun 20, 2022
Malicious code in @corporate/core (npm)
- Jun 20, 2022
Malware in @corporate/core
1 compromised version
- Jun 20, 2022
Malware in @aia-digital/ui-library
1 compromised version
- Jun 20, 2022
Malware in @worki/lib-web-common
1 compromised version
- Jun 20, 2022
Malware in js_packages_security_test
1 compromised version
- Jun 20, 2022
Malicious code in @worki/lib-candidate-common (npm)
- Jun 20, 2022
Malicious code in @sbbol/common (npm)
- Jun 20, 2022
Malicious code in @sbbol/business (npm)
- Jun 20, 2022
Malicious code in @media-ui/core (npm)
- Jun 20, 2022
Malware in @sbbol/business
1 compromised version
- Jun 20, 2022
Malware in @media-ui/core
1 compromised version
- Jun 20, 2022
Malware in @sbbol/common
1 compromised version
- Jun 20, 2022
Malware in @worki/lib-candidate-common
1 compromised version
- Jun 20, 2022
Malicious code in alicloud-ui3 (npm)
- Jun 20, 2022
Malicious code in alicloud-components (npm)
- Jun 20, 2022
Malicious code in @sbbol/web-library (npm)
- Jun 20, 2022
Malicious code in @sbbol/icons (npm)
- Jun 20, 2022
Malware in alicloud-ui3
1 compromised version
- Jun 20, 2022
Malware in alicloud-components
1 compromised version
- Jun 20, 2022
Malware in @sbbol/web-library
1 compromised version
- Jun 20, 2022
Malware in @sbbol/icons
1 compromised version
- Jun 20, 2022
Malicious code in ae-global (npm)
- Jun 20, 2022
Malicious code in target-ui (npm)
- Jun 20, 2022
Malicious code in mcs-utils (npm)
- Jun 20, 2022
Malicious code in mailru-auth-gate (npm)
- Jun 20, 2022
Malware in ae-global
1 compromised version
- Jun 20, 2022
Malware in mcs-utils
1 compromised version
- Jun 20, 2022
Malware in mailru-auth-gate
1 compromised version
- Jun 20, 2022
Malware in target-ui
1 compromised version
- Jun 20, 2022
Malicious code in shodanio (npm)
- Jun 20, 2022
Malicious code in omh (npm)
- Jun 20, 2022
Malicious code in frontend-src (npm)
- Jun 20, 2022
Malicious code in driverportal (npm)
- Jun 20, 2022
Malware in shodanio
1 compromised version
- Jun 20, 2022
Malware in driverportal
1 compromised version
- Jun 20, 2022
Malware in omh
1 compromised version
- Jun 20, 2022
Malware in frontend-src
1 compromised version
- Jun 20, 2022
Malicious code in dklive-event-gateway (npm)
- Jun 20, 2022
Malicious code in com.thomsonreuters.project (npm)
- Jun 20, 2022
Malicious code in com.thomsonreuters.brandedtemplates-int (npm)
- Jun 20, 2022
Malicious code in blockstack-stats (npm)
Page 7123 of 7,293