Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in cornershop-chat
1 compromised version
- Jun 20, 2022
Malware in tulip-backend
1 compromised version
- Jun 20, 2022
Malware in dependency-with-range
1 compromised version
- Jun 20, 2022
Malware in stripe-samples
1 compromised version
- Jun 20, 2022
Malicious code in yhint (npm)
- Jun 20, 2022
Malicious code in txwrapper-acala (npm)
- Jun 20, 2022
Malicious code in bunny-v3 (npm)
- Jun 20, 2022
Malicious code in arbos-contracts (npm)
- Jun 20, 2022
Malware in txwrapper-acala
1 compromised version
- Jun 20, 2022
Malware in bunny-v3
1 compromised version
- Jun 20, 2022
Malware in yhint
1 compromised version
- Jun 20, 2022
Malware in arbos-contracts
1 compromised version
- Jun 20, 2022
Malicious code in grunt-scratchy (npm)
- Jun 20, 2022
Malicious code in gaia-dialog (npm)
- Jun 20, 2022
Malicious code in gaia-component (npm)
- Jun 20, 2022
Malicious code in carpenter-api-client (npm)
- Jun 20, 2022
Malware in gaia-dialog
1 compromised version
- Jun 20, 2022
Malware in grunt-scratchy
1 compromised version
- Jun 20, 2022
Malware in carpenter-api-client
1 compromised version
- Jun 20, 2022
Malware in gaia-component
1 compromised version
- Jun 20, 2022
Malicious code in rcv-with-plugins (npm)
- Jun 20, 2022
Malicious code in rce-with-plugins (npm)
- Jun 20, 2022
Malicious code in obloq (npm)
- Jun 20, 2022
Malicious code in mynpmpackage-njs (npm)
- Jun 20, 2022
Malicious code in editor-with-wrapper-no-modal (npm)
- Jun 20, 2022
Malware in mynpmpackage-njs
1 compromised version
- Jun 20, 2022
Malware in rcv-with-plugins
1 compromised version
- Jun 20, 2022
Malware in obloq
1 compromised version
- Jun 20, 2022
Malware in rce-with-plugins
1 compromised version
- Jun 20, 2022
Malware in editor-with-wrapper-no-modal
1 compromised version
- Jun 20, 2022
Malicious code in wixapps (npm)
- Jun 20, 2022
Malicious code in wix-form-builder (npm)
- Jun 20, 2022
Malicious code in viewer-with-wrapper (npm)
- Jun 20, 2022
Malicious code in editor-with-wrapper (npm)
- Jun 20, 2022
Malware in editor-with-wrapper
1 compromised version
- Jun 20, 2022
Malware in wixapps
1 compromised version
- Jun 20, 2022
Malware in viewer-with-wrapper
1 compromised version
- Jun 20, 2022
Malware in wix-form-builder
1 compromised version
- Jun 20, 2022
Malicious code in sm-js-sdk (npm)
- Jun 20, 2022
Malicious code in ricos-viewer-no-modal (npm)
- Jun 20, 2022
Malicious code in ricos-editor-no-modal (npm)
- Jun 20, 2022
Malicious code in ricos-docs (npm)
- Jun 20, 2022
Malware in ricos-editor-no-modal
1 compromised version
- Jun 20, 2022
Malware in ricos-viewer-no-modal
1 compromised version
- Jun 20, 2022
Malware in ricos-docs
1 compromised version
- Jun 20, 2022
Malware in sm-js-sdk
1 compromised version
- Jun 20, 2022
Malicious code in wix-users (npm)
- Jun 20, 2022
Malicious code in klokl-nirob (npm)
- Jun 20, 2022
Malicious code in js-wixcode-sdk (npm)
- Jun 20, 2022
Malicious code in fucking-n-pack (npm)
Page 7126 of 7,293