Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in nsg-epa
1 compromised version
- Jun 20, 2022
Malware in legacycloudkitresolutionserviceprotocol
1 compromised version
- Jun 20, 2022
Malware in whiteline
1 compromised version
- Jun 20, 2022
Malware in ns-nfactor
1 compromised version
- Jun 20, 2022
Malicious code in suggests (npm)
- Jun 20, 2022
Malicious code in feast-svg (npm)
- Jun 20, 2022
Malicious code in feast-css (npm)
- Jun 20, 2022
Malicious code in 2kit (npm)
- Jun 20, 2022
Malware in feast-svg
1 compromised version
- Jun 20, 2022
Malware in 2kit
1 compromised version
- Jun 20, 2022
Malware in suggests
1 compromised version
- Jun 20, 2022
Malware in feast-css
1 compromised version
- Jun 20, 2022
Malicious code in @specials/resources (npm)
- Jun 20, 2022
Malicious code in @specials/request-tinkoff (npm)
- Jun 20, 2022
Malicious code in @specials/ib-auth (npm)
- Jun 20, 2022
Malicious code in @fb-pfpcommon/core (npm)
- Jun 20, 2022
Malware in @specials/resources
1 compromised version
- Jun 20, 2022
Malware in @specials/ib-auth
1 compromised version
- Jun 20, 2022
Malware in @specials/request-tinkoff
1 compromised version
- Jun 20, 2022
Malware in @fb-pfpcommon/core
1 compromised version
- Jun 20, 2022
Malicious code in @tinkoff-component/appointment (npm)
- Jun 20, 2022
Malicious code in @specials/obid (npm)
- Jun 20, 2022
Malicious code in @specials/iframe (npm)
- Jun 20, 2022
Malicious code in @media-spec/core (npm)
- Jun 20, 2022
Malware in @specials/iframe
1 compromised version
- Jun 20, 2022
Malware in @specials/obid
1 compromised version
- Jun 20, 2022
Malware in @media-spec/core
1 compromised version
- Jun 20, 2022
Malware in @tinkoff-component/appointment
1 compromised version
- Jun 20, 2022
Malicious code in @specials/socials-sharing (npm)
- Jun 20, 2022
Malicious code in @specials/match-media (npm)
- Jun 20, 2022
Malicious code in @specials/localstorage (npm)
- Jun 20, 2022
Malicious code in @specials/form-utils (npm)
- Jun 20, 2022
Malware in @specials/localstorage
1 compromised version
- Jun 20, 2022
Malware in @specials/match-media
1 compromised version
- Jun 20, 2022
Malware in @specials/form-utils
1 compromised version
- Jun 20, 2022
Malware in @specials/socials-sharing
1 compromised version
- Jun 20, 2022
Malicious code in alfaform-core-ui (npm)
- Jun 20, 2022
Malicious code in afisha-common (npm)
- Jun 20, 2022
Malicious code in tinkoff-offers (npm)
- Jun 20, 2022
Malicious code in arui-logger (npm)
- Jun 20, 2022
Malware in tinkoff-offers
1 compromised version
- Jun 20, 2022
Malware in alfaform-core-ui
1 compromised version
- Jun 20, 2022
Malware in arui-logger
1 compromised version
- Jun 20, 2022
Malware in afisha-common
1 compromised version
- Jun 20, 2022
Malicious code in thrift-services (npm)
- Jun 20, 2022
Malicious code in newclick-composite-components (npm)
- Jun 20, 2022
Malicious code in newclick-components (npm)
- Jun 20, 2022
Malicious code in arui-private (npm)
- Jun 20, 2022
Malicious code in arui-ft-private (npm)
- Jun 20, 2022
Malware in thrift-services
1 compromised version
Page 7153 of 7,293