Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in frontend-melidata
1 compromised version
- Jun 20, 2022
Malware in frontend-i18n
1 compromised version
- Jun 20, 2022
Malicious code in wso-core (npm)
- Jun 20, 2022
Malicious code in frontend-hotjar (npm)
- Jun 20, 2022
Malicious code in frontend-analytics (npm)
- Jun 20, 2022
Malicious code in aw-ks (npm)
- Jun 20, 2022
Malware in aw-ks
1 compromised version
- Jun 20, 2022
Malware in wso-core
1 compromised version
- Jun 20, 2022
Malware in frontend-analytics
1 compromised version
- Jun 20, 2022
Malware in frontend-hotjar
1 compromised version
- Jun 20, 2022
Malicious code in thesis-form (npm)
- Jun 20, 2022
Malicious code in grammarly-editor (npm)
- Jun 20, 2022
Malicious code in gnarclientweb (npm)
- Jun 20, 2022
Malicious code in documentalist-monorepo (npm)
- Jun 20, 2022
Malicious code in bender-webpack (npm)
- Jun 20, 2022
Malware in thesis-form
1 compromised version
- Jun 20, 2022
Malware in gnarclientweb
1 compromised version
- Jun 20, 2022
Malware in bender-webpack
1 compromised version
- Jun 20, 2022
Malware in grammarly-editor
1 compromised version
- Jun 20, 2022
Malware in documentalist-monorepo
1 compromised version
- Jun 20, 2022
Malicious code in admin-palantir (npm)
- Jun 20, 2022
Malicious code in tslint-playground (npm)
- Jun 20, 2022
Malicious code in documentalist-monorepo2 (npm)
- Jun 20, 2022
Malware in admin-palantir
1 compromised version
- Jun 20, 2022
Malware in tslint-playground
1 compromised version
- Jun 20, 2022
Malware in documentalist-monorepo2
1 compromised version
- Jun 20, 2022
Malicious code in test-react15 (npm)
- Jun 20, 2022
Malicious code in phishcatch (npm)
- Jun 20, 2022
Malicious code in conjure-typescript-runtime (npm)
- Jun 20, 2022
Malicious code in conjure-receipe-example-app (npm)
- Jun 20, 2022
Malicious code in blueprintjs-monorepo (npm)
- Jun 20, 2022
Malware in conjure-typescript-runtime
1 compromised version
- Jun 20, 2022
Malware in conjure-receipe-example-app
1 compromised version
- Jun 20, 2022
Malware in test-react15
1 compromised version
- Jun 20, 2022
Malware in blueprintjs-monorepo
1 compromised version
- Jun 20, 2022
Malware in phishcatch
1 compromised version
- Jun 20, 2022
Malicious code in sdm.checkout (npm)
- Jun 20, 2022
Malicious code in react-full-stack-starter-client (npm)
- Jun 20, 2022
Malicious code in invlid-tools (npm)
- Jun 20, 2022
Malicious code in grunt-tslint-eslint-config-palantir (npm)
- Jun 20, 2022
Malware in invlid-tools
1 compromised version
- Jun 20, 2022
Malware in react-full-stack-starter-client
1 compromised version
- Jun 20, 2022
Malware in sdm.checkout
1 compromised version
- Jun 20, 2022
Malware in grunt-tslint-eslint-config-palantir
1 compromised version
- Jun 20, 2022
Malicious code in table-dev-app (npm)
- Jun 20, 2022
Malicious code in stylelint-config-monorepo-palantir (npm)
- Jun 20, 2022
Malicious code in policy-bot (npm)
- Jun 20, 2022
Malicious code in meteor-spyfall (npm)
- Jun 20, 2022
Malware in table-dev-app
1 compromised version
- Jun 20, 2022
Malware in stylelint-config-monorepo-palantir
1 compromised version
Page 7131 of 7,293