Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in deneuve-package-test
1 compromised version
- Jun 20, 2022
Malware in react-popper-latest
1 compromised version
- Jun 20, 2022
Malicious code in vue-dexpot-dk (npm)
- Jun 20, 2022
Malicious code in @sfcc-core/logger (npm)
- Jun 20, 2022
Malicious code in @sfcc-core/core-graphql (npm)
- Jun 20, 2022
Malicious code in @sfcc-bff/productapi (npm)
- Jun 20, 2022
Malware in @sfcc-core/core-graphql
1 compromised version
- Jun 20, 2022
Malware in @sfcc-bff/productapi
1 compromised version
- Jun 20, 2022
Malware in @sfcc-core/logger
1 compromised version
- Jun 20, 2022
Malware in vue-dexpot-dk
1 compromised version
- Jun 20, 2022
Malicious code in @adnovum-eslint/eslint-plugin (npm)
- Jun 20, 2022
Malicious code in @sfcc-core/apiconfig (npm)
- Jun 20, 2022
Malicious code in @a4u/a4u-collection-react-spectrum-open-source-color-icons-release (npm)
- Jun 20, 2022
Malicious code in pratikyadavsm1 (npm)
- Jun 20, 2022
Malicious code in pratikyadavsm (npm)
- Jun 20, 2022
Malware in pratikyadavsm1
1 compromised version
- Jun 20, 2022
Malware in pratikyadavsm
1 compromised version
- Jun 20, 2022
Malware in @a4u/a4u-collection-react-spectrum-open-source-color-icons-release
1 compromised version
- Jun 20, 2022
Malware in @sfcc-core/apiconfig
1 compromised version
- Jun 20, 2022
Malware in @adnovum-eslint/eslint-plugin
1 compromised version
- Jun 20, 2022
Malicious code in @wso-utils/localization (npm)
- Jun 20, 2022
Malicious code in @wso-utils/json-mapper (npm)
- Jun 20, 2022
Malicious code in @wso-utils/form-utils (npm)
- Jun 20, 2022
Malicious code in sp-test-core (npm)
- Jun 20, 2022
Malware in @wso-utils/localization
1 compromised version
- Jun 20, 2022
Malware in @wso-utils/json-mapper
1 compromised version
- Jun 20, 2022
Malware in sp-test-core
1 compromised version
- Jun 20, 2022
Malware in @wso-utils/form-utils
1 compromised version
- Jun 20, 2022
Malicious code in zmarta-experiments (npm)
- Jun 20, 2022
Malicious code in sp-messaging-core (npm)
- Jun 20, 2022
Malicious code in rcmp-ui (npm)
- Jun 20, 2022
Malicious code in express-metrics-zmarta (npm)
- Jun 20, 2022
Malware in sp-messaging-core
1 compromised version
- Jun 20, 2022
Malware in express-metrics-zmarta
1 compromised version
- Jun 20, 2022
Malware in rcmp-ui
1 compromised version
- Jun 20, 2022
Malware in zmarta-experiments
1 compromised version
- Jun 20, 2022
Malicious code in frontend-style (npm)
- Jun 20, 2022
Malicious code in frontend-script (npm)
- Jun 20, 2022
Malicious code in frontend-restclient (npm)
- Jun 20, 2022
Malicious code in frontend-page (npm)
- Jun 20, 2022
Malware in frontend-restclient
1 compromised version
- Jun 20, 2022
Malware in frontend-script
1 compromised version
- Jun 20, 2022
Malware in frontend-page
1 compromised version
- Jun 20, 2022
Malware in frontend-style
1 compromised version
- Jun 20, 2022
Malicious code in frontend-melidata (npm)
- Jun 20, 2022
Malicious code in frontend-image (npm)
- Jun 20, 2022
Malicious code in frontend-i18n (npm)
- Jun 20, 2022
Malicious code in frontend-hydrate (npm)
- Jun 20, 2022
Malware in frontend-hydrate
1 compromised version
- Jun 20, 2022
Malware in frontend-image
1 compromised version
Page 7130 of 7,293