Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in schedviz
1 compromised version
- Jun 20, 2022
Malware in scrollytell
1 compromised version
- Jun 20, 2022
Malware in @coderscamp/eslint-plugin
1 compromised version
- Jun 20, 2022
Malware in npm-rce-hackerone-corraldev
1 compromised version
- Jun 20, 2022
Malicious code in shaka-streamer (npm)
- Jun 20, 2022
Malicious code in service-worker-detector (npm)
- Jun 20, 2022
Malicious code in seo-pwa (npm)
- Jun 20, 2022
Malicious code in selinux-policy-languages (npm)
- Jun 20, 2022
Malware in selinux-policy-languages
1 compromised version
- Jun 20, 2022
Malware in seo-pwa
1 compromised version
- Jun 20, 2022
Malware in service-worker-detector
1 compromised version
- Jun 20, 2022
Malware in shaka-streamer
1 compromised version
- Jun 20, 2022
Malicious code in vulncode-db404 (npm)
- Jun 20, 2022
Malicious code in vscode-bigquery (npm)
- Jun 20, 2022
Malicious code in trillian-website (npm)
- Jun 20, 2022
Malicious code in tech-doc-hugo (npm)
- Jun 20, 2022
Malware in trillian-website
1 compromised version
- Jun 20, 2022
Malware in vscode-bigquery
1 compromised version
- Jun 20, 2022
Malware in tech-doc-hugo
1 compromised version
- Jun 20, 2022
Malware in vulncode-db404
1 compromised version
- Jun 20, 2022
Malicious code in zazu-nam (npm)
- Jun 20, 2022
Malicious code in wikiloop-doublecheck (npm)
- Jun 20, 2022
Malicious code in webfundamentals (npm)
- Jun 20, 2022
Malicious code in web-stories-wp (npm)
- Jun 20, 2022
Malware in wikiloop-doublecheck
1 compromised version
- Jun 20, 2022
Malware in web-stories-wp
1 compromised version
- Jun 20, 2022
Malware in webfundamentals
1 compromised version
- Jun 20, 2022
Malware in zazu-nam
1 compromised version
- Jun 20, 2022
Malicious code in ampcidapi (npm)
- Jun 20, 2022
Malicious code in aidl-language (npm)
- Jun 20, 2022
Malicious code in aeux (npm)
- Jun 20, 2022
Malicious code in angular-a11y-workshop (npm)
- Jun 20, 2022
Malware in aeux
1 compromised version
- Jun 20, 2022
Malware in aidl-language
1 compromised version
- Jun 20, 2022
Malware in angular-a11y-workshop
1 compromised version
- Jun 20, 2022
Malware in ampcidapi
1 compromised version
- Jun 20, 2022
Malicious code in blockly-devtools (npm)
- Jun 20, 2022
Malicious code in automation-inspector (npm)
- Jun 20, 2022
Malicious code in asset-check (npm)
- Jun 20, 2022
Malicious code in angularfire-seed (npm)
- Jun 20, 2022
Malicious code in angular-link-diver (npm)
- Jun 20, 2022
Malware in angularfire-seed
1 compromised version
- Jun 20, 2022
Malware in blockly-devtools
1 compromised version
- Jun 20, 2022
Malware in asset-check
1 compromised version
- Jun 20, 2022
Malware in angular-link-diver
1 compromised version
- Jun 20, 2022
Malware in automation-inspector
1 compromised version
- Jun 20, 2022
Malicious code in certificate-maker (npm)
- Jun 20, 2022
Malicious code in capacitybot-cf-nodejs-fct (npm)
- Jun 20, 2022
Malicious code in blockly-samples (npm)
- Jun 20, 2022
Malware in certificate-maker
1 compromised version
Page 7139 of 7,293