Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,706 total · sorted newest first- Jun 20, 2022
Malicious code in pratikyadavsm1 (npm)
- Jun 20, 2022
Malicious code in pratikyadavsm (npm)
- Jun 20, 2022
Malware in pratikyadavsm1
1 compromised version
- Jun 20, 2022
Malware in pratikyadavsm
1 compromised version
- Jun 20, 2022
Malware in @a4u/a4u-collection-react-spectrum-open-source-color-icons-release
1 compromised version
- Jun 20, 2022
Malware in @sfcc-core/apiconfig
1 compromised version
- Jun 20, 2022
Malware in @adnovum-eslint/eslint-plugin
1 compromised version
- Jun 20, 2022
Malicious code in @wso-utils/localization (npm)
- Jun 20, 2022
Malicious code in @wso-utils/json-mapper (npm)
- Jun 20, 2022
Malicious code in @wso-utils/form-utils (npm)
- Jun 20, 2022
Malicious code in sp-test-core (npm)
- Jun 20, 2022
Malware in @wso-utils/localization
1 compromised version
- Jun 20, 2022
Malware in @wso-utils/json-mapper
1 compromised version
- Jun 20, 2022
Malware in sp-test-core
1 compromised version
- Jun 20, 2022
Malware in @wso-utils/form-utils
1 compromised version
- Jun 20, 2022
Malicious code in zmarta-experiments (npm)
- Jun 20, 2022
Malicious code in sp-messaging-core (npm)
- Jun 20, 2022
Malicious code in rcmp-ui (npm)
- Jun 20, 2022
Malicious code in express-metrics-zmarta (npm)
- Jun 20, 2022
Malware in sp-messaging-core
1 compromised version
- Jun 20, 2022
Malware in express-metrics-zmarta
1 compromised version
- Jun 20, 2022
Malware in rcmp-ui
1 compromised version
- Jun 20, 2022
Malware in zmarta-experiments
1 compromised version
- Jun 20, 2022
Malicious code in frontend-style (npm)
- Jun 20, 2022
Malicious code in frontend-script (npm)
- Jun 20, 2022
Malicious code in frontend-restclient (npm)
- Jun 20, 2022
Malicious code in frontend-page (npm)
- Jun 20, 2022
Malware in frontend-restclient
1 compromised version
- Jun 20, 2022
Malware in frontend-script
1 compromised version
- Jun 20, 2022
Malware in frontend-page
1 compromised version
- Jun 20, 2022
Malware in frontend-style
1 compromised version
- Jun 20, 2022
Malicious code in frontend-melidata (npm)
- Jun 20, 2022
Malicious code in frontend-image (npm)
- Jun 20, 2022
Malicious code in frontend-i18n (npm)
- Jun 20, 2022
Malicious code in frontend-hydrate (npm)
- Jun 20, 2022
Malware in frontend-hydrate
1 compromised version
- Jun 20, 2022
Malware in frontend-image
1 compromised version
- Jun 20, 2022
Malware in frontend-melidata
1 compromised version
- Jun 20, 2022
Malware in frontend-i18n
1 compromised version
- Jun 20, 2022
Malicious code in wso-core (npm)
- Jun 20, 2022
Malicious code in frontend-hotjar (npm)
- Jun 20, 2022
Malicious code in frontend-analytics (npm)
- Jun 20, 2022
Malicious code in aw-ks (npm)
- Jun 20, 2022
Malware in aw-ks
1 compromised version
- Jun 20, 2022
Malware in wso-core
1 compromised version
- Jun 20, 2022
Malware in frontend-analytics
1 compromised version
- Jun 20, 2022
Malware in frontend-hotjar
1 compromised version
- Jun 20, 2022
Malicious code in thesis-form (npm)
- Jun 20, 2022
Malicious code in grammarly-editor (npm)
- Jun 20, 2022
Malicious code in gnarclientweb (npm)
Page 7132 of 7,295