Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in newclick-components
1 compromised version
- Jun 20, 2022
Malware in arui-private
1 compromised version
- Jun 20, 2022
Malware in newclick-composite-components
1 compromised version
- Jun 20, 2022
Malware in arui-ft-private
1 compromised version
- Jun 20, 2022
Malicious code in tinkoff-form-builder (npm)
- Jun 20, 2022
Malicious code in sportsbook-frontend-integration (npm)
- Jun 20, 2022
Malicious code in corporate-services (npm)
- Jun 20, 2022
Malicious code in babel-plugin-transform-require-ensure (npm)
- Jun 20, 2022
Malware in tinkoff-form-builder
1 compromised version
- Jun 20, 2022
Malware in corporate-services
1 compromised version
- Jun 20, 2022
Malware in sportsbook-frontend-integration
1 compromised version
- Jun 20, 2022
Malware in babel-plugin-transform-require-ensure
1 compromised version
- Jun 20, 2022
Malicious code in eva.io-core (npm)
- Jun 20, 2022
Malicious code in eslint-plugin-tinkoff (npm)
- Jun 20, 2022
Malicious code in dippy (npm)
- Jun 20, 2022
Malicious code in browser-timings (npm)
- Jun 20, 2022
Malware in dippy
1 compromised version
- Jun 20, 2022
Malware in eva.io-core
1 compromised version
- Jun 20, 2022
Malware in browser-timings
1 compromised version
- Jun 20, 2022
Malware in eslint-plugin-tinkoff
1 compromised version
- Jun 20, 2022
Malicious code in router-way (npm)
- Jun 20, 2022
Malicious code in route-train (npm)
- Jun 20, 2022
Malicious code in page-blocks (npm)
- Jun 20, 2022
Malicious code in eva.io-docker (npm)
- Jun 20, 2022
Malware in eva.io-docker
1 compromised version
- Jun 20, 2022
Malware in page-blocks
1 compromised version
- Jun 20, 2022
Malware in router-way
1 compromised version
- Jun 20, 2022
Malware in route-train
1 compromised version
- Jun 20, 2022
Malicious code in tinkoff-push-web (npm)
- Jun 20, 2022
Malicious code in tinkoff-insurance-utils (npm)
- Jun 20, 2022
Malicious code in express-uatraits (npm)
- Jun 20, 2022
Malicious code in express-blackbox (npm)
- Jun 20, 2022
Malware in tinkoff-push-web
1 compromised version
- Jun 20, 2022
Malware in express-blackbox
1 compromised version
- Jun 20, 2022
Malware in express-uatraits
1 compromised version
- Jun 20, 2022
Malware in tinkoff-insurance-utils
1 compromised version
- Jun 20, 2022
Malicious code in yandex-csrf (npm)
- Jun 20, 2022
Malicious code in tvmtool-bin (npm)
- Jun 20, 2022
Malicious code in lego-on-react (npm)
- Jun 20, 2022
Malicious code in express-yandexuid (npm)
- Jun 20, 2022
Malware in yandex-csrf
1 compromised version
- Jun 20, 2022
Malware in express-yandexuid
1 compromised version
- Jun 20, 2022
Malware in lego-on-react
1 compromised version
- Jun 20, 2022
Malware in tvmtool-bin
1 compromised version
- Jun 20, 2022
Malicious code in ymaps-host-configs (npm)
- Jun 20, 2022
Malicious code in yandex-mycookie (npm)
- Jun 20, 2022
Malicious code in yandex-langdetect-mock (npm)
- Jun 20, 2022
Malicious code in eslint-plugin-yandex-maps (npm)
- Jun 20, 2022
Malware in eslint-plugin-yandex-maps
1 compromised version
- Jun 20, 2022
Malware in yandex-langdetect-mock
1 compromised version
Page 7154 of 7,293