Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malicious code in atlas-ui-framework (npm)
- Jun 20, 2022
Malware in atlas-ui-framework
1 compromised version
- Jun 20, 2022
Malware in com.thomsonreuters.brandedtemplates-int
1 compromised version
- Jun 20, 2022
Malware in dklive-event-gateway
1 compromised version
- Jun 20, 2022
Malware in blockstack-stats
1 compromised version
- Jun 20, 2022
Malware in com.thomsonreuters.project
1 compromised version
- Jun 20, 2022
Malicious code in ux-gulp-theming (npm)
- Jun 20, 2022
Malicious code in portal-web (npm)
- Jun 20, 2022
Malicious code in mindtap-static-lib (npm)
- Jun 20, 2022
Malicious code in dklive-admin-api (npm)
- Jun 20, 2022
Malware in ux-gulp-theming
1 compromised version
- Jun 20, 2022
Malware in dklive-admin-api
1 compromised version
- Jun 20, 2022
Malware in mindtap-static-lib
1 compromised version
- Jun 20, 2022
Malware in portal-web
1 compromised version
- Jun 20, 2022
Malicious code in zmp-cli-dev (npm)
- Jun 20, 2022
Malicious code in tv_home (npm)
- Jun 20, 2022
Malicious code in doffy-publish-to-npm (npm)
- Jun 20, 2022
Malicious code in debuug (npm)
- Jun 20, 2022
Malware in tv_home
1 compromised version
- Jun 20, 2022
Malware in zmp-cli-dev
1 compromised version
- Jun 20, 2022
Malware in doffy-publish-to-npm
1 compromised version
- Jun 20, 2022
Malware in debuug
1 compromised version
- Jun 20, 2022
Malicious code in tchalk (npm)
- Jun 20, 2022
Malicious code in slack-github-action (npm)
- Jun 20, 2022
Malicious code in request-progres (npm)
- Jun 20, 2022
Malicious code in isntal (npm)
- Jun 20, 2022
Malware in tchalk
1 compromised version
- Jun 20, 2022
Malware in slack-github-action
1 compromised version
- Jun 20, 2022
Malware in isntal
1 compromised version
- Jun 20, 2022
Malware in request-progres
1 compromised version
- Jun 20, 2022
Malicious code in steamdb-browser-extension (npm)
- Jun 20, 2022
Malicious code in ems-file-service (npm)
- Jun 20, 2022
Malicious code in e2e-synthetics (npm)
- Jun 20, 2022
Malicious code in app-incident-bot (npm)
- Jun 20, 2022
Malware in steamdb-browser-extension
1 compromised version
- Jun 20, 2022
Malware in app-incident-bot
1 compromised version
- Jun 20, 2022
Malware in ems-file-service
1 compromised version
- Jun 20, 2022
Malware in e2e-synthetics
1 compromised version
- Jun 20, 2022
Malicious code in opbeans-node (npm)
- Jun 20, 2022
Malicious code in link-kibana (npm)
- Jun 20, 2022
Malicious code in eui-cljs (npm)
- Jun 20, 2022
Malicious code in elastic-charts-mono (npm)
- Jun 20, 2022
Malware in eui-cljs
1 compromised version
- Jun 20, 2022
Malware in opbeans-node
1 compromised version
- Jun 20, 2022
Malware in elastic-charts-mono
1 compromised version
- Jun 20, 2022
Malware in link-kibana
1 compromised version
- Jun 20, 2022
Malicious code in wickrio-proxy-bot (npm)
- Jun 20, 2022
Malicious code in wickrcrypto (npm)
- Jun 20, 2022
Malicious code in instacart-javascript (npm)
- Jun 20, 2022
Malicious code in broadcast-bot-web (npm)
Page 7124 of 7,293