Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in weixao
1 compromised version
- Jun 20, 2022
Malware in simplesamlphp
1 compromised version
- Jun 20, 2022
Malware in nixpsweb
1 compromised version
- Jun 20, 2022
Malware in josquin-ribbon
1 compromised version
- Jun 20, 2022
Malicious code in hippocrates (npm)
- Jun 20, 2022
Malicious code in gap-r (npm)
- Jun 20, 2022
Malicious code in dashticz (npm)
- Jun 20, 2022
Malicious code in cisco-bem-network-test (npm)
- Jun 20, 2022
Malware in hippocrates
1 compromised version
- Jun 20, 2022
Malware in cisco-bem-network-test
1 compromised version
- Jun 20, 2022
Malware in gap-r
1 compromised version
- Jun 20, 2022
Malware in dashticz
1 compromised version
- Jun 20, 2022
Malicious code in shipping-notice-ui-proxy (npm)
- Jun 20, 2022
Malicious code in runeaudio-runeui (npm)
- Jun 20, 2022
Malicious code in mytestnpmaskedrisec (npm)
- Jun 20, 2022
Malicious code in cf-scraper (npm)
- Jun 20, 2022
Malware in runeaudio-runeui
1 compromised version
- Jun 20, 2022
Malware in cf-scraper
1 compromised version
- Jun 20, 2022
Malware in mytestnpmaskedrisec
1 compromised version
- Jun 20, 2022
Malware in shipping-notice-ui-proxy
1 compromised version
- Jun 20, 2022
Malicious code in amorphic-framework (npm)
- Jun 20, 2022
Malicious code in security-poc (npm)
- Jun 20, 2022
Malicious code in intersting_package_bhavik (npm)
- Jun 20, 2022
Malicious code in haven-design-system-static (npm)
- Jun 20, 2022
Malware in security-poc
1 compromised version
- Jun 20, 2022
Malware in intersting_package_bhavik
1 compromised version
- Jun 20, 2022
Malware in amorphic-framework
1 compromised version
- Jun 20, 2022
Malware in haven-design-system-static
1 compromised version
- Jun 20, 2022
Malicious code in kentik-viz (npm)
- Jun 20, 2022
Malicious code in fabric-vue (npm)
- Jun 20, 2022
Malicious code in fabric-design (npm)
- Jun 20, 2022
Malicious code in boss-alien-media-player (npm)
- Jun 20, 2022
Malware in fabric-design
1 compromised version
- Jun 20, 2022
Malware in fabric-vue
1 compromised version
- Jun 20, 2022
Malware in kentik-viz
1 compromised version
- Jun 20, 2022
Malware in boss-alien-media-player
1 compromised version
- Jun 20, 2022
Malicious code in nw-api-sdk (npm)
- Jun 20, 2022
Malicious code in note-taking (npm)
- Jun 20, 2022
Malicious code in deneuve-package-parent (npm)
- Jun 20, 2022
Malicious code in deneuve-package-ok (npm)
- Jun 20, 2022
Malware in deneuve-package-parent
1 compromised version
- Jun 20, 2022
Malware in note-taking
1 compromised version
- Jun 20, 2022
Malware in deneuve-package-ok
1 compromised version
- Jun 20, 2022
Malware in nw-api-sdk
1 compromised version
- Jun 20, 2022
Malicious code in react-popper-latest (npm)
- Jun 20, 2022
Malicious code in editor-sdk-react (npm)
- Jun 20, 2022
Malicious code in deneuve-package-test (npm)
- Jun 20, 2022
Malicious code in deneuve-package-private (npm)
- Jun 20, 2022
Malware in deneuve-package-private
1 compromised version
- Jun 20, 2022
Malware in editor-sdk-react
1 compromised version
Page 7129 of 7,293