Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in mrmax
1 compromised version
- Jun 20, 2022
Malware in mrmax4o4
1 compromised version
- Jun 20, 2022
Malicious code in sharded-redis-client (npm)
- Jun 20, 2022
Malicious code in mkr-vote-proxy (npm)
- Jun 20, 2022
Malicious code in gtt-ui (npm)
- Jun 20, 2022
Malicious code in asls (npm)
- Jun 20, 2022
Malware in gtt-ui
1 compromised version
- Jun 20, 2022
Malware in mkr-vote-proxy
1 compromised version
- Jun 20, 2022
Malware in asls
1 compromised version
- Jun 20, 2022
Malware in sharded-redis-client
1 compromised version
- Jun 20, 2022
Malicious code in admin-ui-extensions-template (npm)
- Jun 20, 2022
Malicious code in argo-checkout-template (npm)
- Jun 20, 2022
Malicious code in app_bridge_auth (npm)
- Jun 20, 2022
Malicious code in 0-shadowenv (npm)
- Jun 20, 2022
Malware in app_bridge_auth
1 compromised version
- Jun 20, 2022
Malware in argo-checkout-template
1 compromised version
- Jun 20, 2022
Malware in admin-ui-extensions-template
1 compromised version
- Jun 20, 2022
Malware in 0-shadowenv
1 compromised version
- Jun 20, 2022
Malicious code in ajax-env (npm)
- Jun 20, 2022
Malicious code in advanced-wp-debugger (npm)
- Jun 20, 2022
Malicious code in oss-contribution-tracker (npm)
- Jun 20, 2022
Malicious code in ion-extension (npm)
- Jun 20, 2022
Malware in ajax-env
1 compromised version
- Jun 20, 2022
Malware in oss-contribution-tracker
1 compromised version
- Jun 20, 2022
Malware in ion-extension
1 compromised version
- Jun 20, 2022
Malware in advanced-wp-debugger
1 compromised version
- Jun 20, 2022
Malicious code in amazonlauncherintegration (npm)
- Jun 20, 2022
Malicious code in amazon-oss-attribution-builder (npm)
- Jun 20, 2022
Malicious code in one-question-survey (npm)
- Jun 20, 2022
Malicious code in firefox-send (npm)
- Jun 20, 2022
Malware in amazonlauncherintegration
1 compromised version
- Jun 20, 2022
Malware in amazon-oss-attribution-builder
1 compromised version
- Jun 20, 2022
Malware in firefox-send
1 compromised version
- Jun 20, 2022
Malware in one-question-survey
1 compromised version
- Jun 20, 2022
Malicious code in vulncode-db (npm)
- Jun 20, 2022
Malicious code in dco-bot (npm)
- Jun 20, 2022
Malicious code in data-mil-thor-ww1 (npm)
- Jun 20, 2022
Malicious code in crossfeed (npm)
- Jun 20, 2022
Malware in vulncode-db
1 compromised version
- Jun 20, 2022
Malware in crossfeed
1 compromised version
- Jun 20, 2022
Malware in dco-bot
1 compromised version
- Jun 20, 2022
Malware in data-mil-thor-ww1
1 compromised version
- Jun 20, 2022
Malicious code in tarojs-plugin-platform-lark (npm)
- Jun 20, 2022
Malicious code in spaces-reach (npm)
- Jun 20, 2022
Malicious code in remote-dev-jobs-streamer (npm)
- Jun 20, 2022
Malicious code in fuv-app (npm)
- Jun 20, 2022
Malware in remote-dev-jobs-streamer
1 compromised version
- Jun 20, 2022
Malware in spaces-reach
1 compromised version
- Jun 20, 2022
Malware in fuv-app
1 compromised version
- Jun 20, 2022
Malware in tarojs-plugin-platform-lark
1 compromised version
Page 7143 of 7,293