Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malicious code in lamalo (npm)
- Jun 20, 2022
Malicious code in lamalamalama (npm)
- Jun 20, 2022
Malicious code in lamalama (npm)
- Jun 20, 2022
Malicious code in h1test (npm)
- Jun 20, 2022
Malicious code in fe-datalayer (npm)
- Jun 20, 2022
Malware in lamalamalama
1 compromised version
- Jun 20, 2022
Malware in fe-datalayer
1 compromised version
- Jun 20, 2022
Malware in lamalama
1 compromised version
- Jun 20, 2022
Malware in h1test
1 compromised version
- Jun 20, 2022
Malware in lamalo
1 compromised version
- Jun 20, 2022
Malicious code in stamjs (npm)
- Jun 20, 2022
Malicious code in dm-podcast-web-player (npm)
- Jun 20, 2022
Malicious code in da-uikit (npm)
- Jun 20, 2022
Malicious code in bubujs (npm)
- Jun 20, 2022
Malware in dm-podcast-web-player
1 compromised version
- Jun 20, 2022
Malware in da-uikit
1 compromised version
- Jun 20, 2022
Malware in stamjs
1 compromised version
- Jun 20, 2022
Malware in bubujs
1 compromised version
- Jun 20, 2022
Malicious code in analytics-event-schema (npm)
- Jun 20, 2022
Malicious code in streamer-market-dashboard (npm)
- Jun 20, 2022
Malicious code in react-overlays-wrapper (npm)
- Jun 20, 2022
Malicious code in common-pcode (npm)
- Jun 20, 2022
Malware in analytics-event-schema
1 compromised version
- Jun 20, 2022
Malware in common-pcode
1 compromised version
- Jun 20, 2022
Malware in streamer-market-dashboard
1 compromised version
- Jun 20, 2022
Malware in react-overlays-wrapper
1 compromised version
- Jun 20, 2022
Malicious code in ok-messenger-emoji (npm)
- Jun 20, 2022
Malicious code in ok-message-parser (npm)
- Jun 20, 2022
Malicious code in @msmg/vue-auth-tracking (npm)
- Jun 20, 2022
Malicious code in @msm-app/product-block (npm)
- Jun 20, 2022
Malware in @msmg/vue-auth-tracking
1 compromised version
- Jun 20, 2022
Malware in ok-message-parser
1 compromised version
- Jun 20, 2022
Malware in ok-messenger-emoji
1 compromised version
- Jun 20, 2022
Malware in @msm-app/product-block
1 compromised version
- Jun 20, 2022
Malicious code in @msmg/vue-uid (npm)
- Jun 20, 2022
Malicious code in @msmg/vue-merge-data-qa (npm)
- Jun 20, 2022
Malicious code in @msmg/tracking (npm)
- Jun 20, 2022
Malicious code in @msmg/gtm-events (npm)
- Jun 20, 2022
Malware in @msmg/tracking
1 compromised version
- Jun 20, 2022
Malware in @msmg/vue-uid
1 compromised version
- Jun 20, 2022
Malware in @msmg/gtm-events
1 compromised version
- Jun 20, 2022
Malware in @msmg/vue-merge-data-qa
1 compromised version
- Jun 20, 2022
Malicious code in @otvet/muse-ui (npm)
- Jun 20, 2022
Malicious code in @otvet/advertising (npm)
- Jun 20, 2022
Malicious code in my-oauth (npm)
- Jun 20, 2022
Malicious code in hubspot-url-utils (npm)
- Jun 20, 2022
Malware in hubspot-url-utils
1 compromised version
- Jun 20, 2022
Malware in @otvet/muse-ui
1 compromised version
- Jun 20, 2022
Malware in my-oauth
1 compromised version
- Jun 20, 2022
Malware in @otvet/advertising
1 compromised version
Page 7159 of 7,293