Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malware in ymaps-host-configs
1 compromised version
- Jun 20, 2022
Malware in yandex-mycookie
1 compromised version
- Jun 20, 2022
Malicious code in yandex-dumbledore (npm)
- Jun 20, 2022
Malicious code in react-yandex-favicon (npm)
- Jun 20, 2022
Malicious code in lpc-library (npm)
- Jun 20, 2022
Malicious code in education-components (npm)
- Jun 20, 2022
Malicious code in bering (npm)
- Jun 20, 2022
Malware in lpc-library
1 compromised version
- Jun 20, 2022
Malware in yandex-dumbledore
1 compromised version
- Jun 20, 2022
Malware in bering
1 compromised version
- Jun 20, 2022
Malware in education-components
1 compromised version
- Jun 20, 2022
Malware in react-yandex-favicon
1 compromised version
- Jun 20, 2022
Malicious code in @tochka-modules/t15-ui-kit-icons (npm)
- Jun 20, 2022
Malicious code in @t15-ui-kit/enums (npm)
- Jun 20, 2022
Malicious code in lookout-dingbats (npm)
- Jun 20, 2022
Malicious code in gringotts (npm)
- Jun 20, 2022
Malware in gringotts
1 compromised version
- Jun 20, 2022
Malware in @tochka-modules/t15-ui-kit-icons
1 compromised version
- Jun 20, 2022
Malware in @t15-ui-kit/enums
1 compromised version
- Jun 20, 2022
Malware in lookout-dingbats
1 compromised version
- Jun 20, 2022
Malicious code in adyen-web-drop-in-ui (npm)
- Jun 20, 2022
Malicious code in gatsby-plugin-consent-cookies (npm)
- Jun 20, 2022
Malicious code in cstar-react-primitives (npm)
- Jun 20, 2022
Malicious code in cord-19-ui (npm)
- Jun 20, 2022
Malware in gatsby-plugin-consent-cookies
1 compromised version
- Jun 20, 2022
Malware in adyen-web-drop-in-ui
1 compromised version
- Jun 20, 2022
Malware in cstar-react-primitives
1 compromised version
- Jun 20, 2022
Malware in cord-19-ui
1 compromised version
- Jun 20, 2022
Malicious code in wiki-site (npm)
- Jun 20, 2022
Malicious code in webhooks-server (npm)
- Jun 20, 2022
Malicious code in nylas-webhooks-example (npm)
- Jun 20, 2022
Malicious code in inbox-zero (npm)
- Jun 20, 2022
Malware in webhooks-server
1 compromised version
- Jun 20, 2022
Malware in wiki-site
1 compromised version
- Jun 20, 2022
Malware in nylas-webhooks-example
1 compromised version
- Jun 20, 2022
Malware in inbox-zero
1 compromised version
- Jun 20, 2022
Malicious code in nylas-mail-all (npm)
- Jun 20, 2022
Malicious code in cloud-workers (npm)
- Jun 20, 2022
Malicious code in client-sync (npm)
- Jun 20, 2022
Malicious code in botslives (npm)
- Jun 20, 2022
Malware in client-sync
1 compromised version
- Jun 20, 2022
Malware in nylas-mail-all
1 compromised version
- Jun 20, 2022
Malware in botslives
1 compromised version
- Jun 20, 2022
Malware in cloud-workers
1 compromised version
- Jun 20, 2022
Malicious code in towo (npm)
- Jun 20, 2022
Malicious code in telescope-avatar (npm)
- Jun 20, 2022
Malicious code in klow (npm)
- Jun 20, 2022
Malicious code in appboy (npm)
- Jun 20, 2022
Malware in appboy
1 compromised version
- Jun 20, 2022
Malware in towo
1 compromised version
Page 7155 of 7,293