Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malicious code in supertest222222 (npm)
- Jun 20, 2022
Malicious code in circonus-statsd-backend (npm)
- Jun 20, 2022
Malware in uiq
1 compromised version
- Jun 20, 2022
Malware in supertest222222
1 compromised version
- Jun 20, 2022
Malware in supertest333333
1 compromised version
- Jun 20, 2022
Malware in circonus-statsd-backend
1 compromised version
- Jun 20, 2022
Malicious code in salesforcedx-shell-utils (npm)
- Jun 20, 2022
Malicious code in randompackagetest123_dep (npm)
- Jun 20, 2022
Malicious code in mapbox-studio-pro-fonts (npm)
- Jun 20, 2022
Malicious code in mapbox-studio-default-fonts (npm)
- Jun 20, 2022
Malware in mapbox-studio-pro-fonts
1 compromised version
- Jun 20, 2022
Malware in salesforcedx-shell-utils
1 compromised version
- Jun 20, 2022
Malware in mapbox-studio-default-fonts
1 compromised version
- Jun 20, 2022
Malware in randompackagetest123_dep
1 compromised version
- Jun 20, 2022
Malicious code in randompackagetest123 (npm)
- Jun 20, 2022
Malicious code in fusion-plugin-font-loading (npm)
- Jun 20, 2022
Malicious code in bitcore-build-zcash (npm)
- Jun 20, 2022
Malware in randompackagetest123
1 compromised version
- Jun 20, 2022
Malware in bitcore-build-zcash
1 compromised version
- Jun 20, 2022
Malware in fusion-plugin-font-loading
1 compromised version
- Jun 20, 2022
Malicious code in upwork-atlas-datasource (npm)
- Jun 20, 2022
Malicious code in qiwi-widget-charaty (npm)
- Jun 20, 2022
Malicious code in datadog-serverless-macro (npm)
- Jun 20, 2022
Malicious code in babel-plugin-inline-gl-constants (npm)
- Jun 20, 2022
Malware in babel-plugin-inline-gl-constants
1 compromised version
- Jun 20, 2022
Malware in qiwi-widget-charaty
1 compromised version
- Jun 20, 2022
Malware in upwork-atlas-datasource
1 compromised version
- Jun 20, 2022
Malware in datadog-serverless-macro
1 compromised version
- Jun 20, 2022
Malicious code in zilwrap-sdk (npm)
- Jun 20, 2022
Malicious code in calc_y5wqxinecc (npm)
- Jun 20, 2022
Malicious code in calc_pci3vj0xqv (npm)
- Jun 20, 2022
Malicious code in bitmex-local-proxy (npm)
- Jun 20, 2022
Malware in calc_pci3vj0xqv
1 compromised version
- Jun 20, 2022
Malware in bitmex-local-proxy
1 compromised version
- Jun 20, 2022
Malware in calc_y5wqxinecc
1 compromised version
- Jun 20, 2022
Malware in zilwrap-sdk
1 compromised version
- Jun 20, 2022
Malicious code in mason-auth-middleware (npm)
- Jun 20, 2022
Malicious code in evil-package-no-install (npm)
- Jun 20, 2022
Malicious code in daas-rce-1 (npm)
- Jun 20, 2022
Malicious code in calc_t7x506bhe5 (npm)
- Jun 20, 2022
Malware in daas-rce-1
1 compromised version
- Jun 20, 2022
Malware in calc_t7x506bhe5
1 compromised version
- Jun 20, 2022
Malware in evil-package-no-install
1 compromised version
- Jun 20, 2022
Malware in mason-auth-middleware
1 compromised version
- Jun 20, 2022
Malicious code in secrets-sync-action (npm)
- Jun 20, 2022
Malicious code in scrollytell (npm)
- Jun 20, 2022
Malicious code in schedviz (npm)
- Jun 20, 2022
Malicious code in npm-rce-hackerone-corraldev (npm)
- Jun 20, 2022
Malicious code in @coderscamp/eslint-plugin (npm)
- Jun 20, 2022
Malware in secrets-sync-action
1 compromised version
Page 7138 of 7,293