Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malicious code in visitor-ui-component-library-icons (npm)
- Jun 20, 2022
Malicious code in visitor-ui-component-library (npm)
- Jun 20, 2022
Malicious code in usage-tracker-core (npm)
- Jun 20, 2022
Malicious code in hs-promise-rejection-tracking (npm)
- Jun 20, 2022
Malicious code in hs-loadsh (npm)
- Jun 20, 2022
Malware in usage-tracker-core
1 compromised version
- Jun 20, 2022
Malware in visitor-ui-component-library
1 compromised version
- Jun 20, 2022
Malware in visitor-ui-component-library-icons
1 compromised version
- Jun 20, 2022
Malware in hs-promise-rejection-tracking
1 compromised version
- Jun 20, 2022
Malware in hs-loadsh
1 compromised version
- Jun 20, 2022
Malicious code in signup-ui-core (npm)
- Jun 20, 2022
Malicious code in feedback-utils (npm)
- Jun 20, 2022
Malicious code in feedback-schema (npm)
- Jun 20, 2022
Malicious code in conversations-prop-types (npm)
- Jun 20, 2022
Malware in conversations-prop-types
1 compromised version
- Jun 20, 2022
Malware in feedback-schema
1 compromised version
- Jun 20, 2022
Malware in signup-ui-core
1 compromised version
- Jun 20, 2022
Malware in feedback-utils
1 compromised version
- Jun 20, 2022
Malicious code in forms-embed-utils-lib (npm)
- Jun 20, 2022
Malicious code in feedback-web-renderer-ui (npm)
- Jun 20, 2022
Malicious code in cos-i18n (npm)
- Jun 20, 2022
Malicious code in asset-bender (npm)
- Jun 20, 2022
Malware in cos-i18n
1 compromised version
- Jun 20, 2022
Malware in feedback-web-renderer-ui
1 compromised version
- Jun 20, 2022
Malware in forms-embed-utils-lib
1 compromised version
- Jun 20, 2022
Malware in asset-bender
1 compromised version
- Jun 20, 2022
Malicious code in tinkoff-talk-web (npm)
- Jun 20, 2022
Malicious code in grunt-retina-img (npm)
- Jun 20, 2022
Malicious code in grunt-retina-css (npm)
- Jun 20, 2022
Malicious code in co-browsing (npm)
- Jun 20, 2022
Malware in grunt-retina-css
1 compromised version
- Jun 20, 2022
Malware in grunt-retina-img
1 compromised version
- Jun 20, 2022
Malware in tinkoff-talk-web
1 compromised version
- Jun 20, 2022
Malware in co-browsing
1 compromised version
- Jun 20, 2022
Malicious code in shineout-mobile (npm)
- Jun 20, 2022
Malicious code in okapi-doc (npm)
- Jun 20, 2022
Malicious code in grunttools (npm)
- Jun 20, 2022
Malicious code in carousel-enabledx (npm)
- Jun 20, 2022
Malware in carousel-enabledx
1 compromised version
- Jun 20, 2022
Malware in okapi-doc
1 compromised version
- Jun 20, 2022
Malware in grunttools
1 compromised version
- Jun 20, 2022
Malware in shineout-mobile
1 compromised version
- Jun 20, 2022
Malicious code in @tampmd/utils (npm)
- Jun 20, 2022
Malicious code in @tampmd/hyperion-ui (npm)
- Jun 20, 2022
Malicious code in @tampmd/bth-react-components (npm)
- Jun 20, 2022
Malicious code in shein-icon (npm)
- Jun 20, 2022
Malware in shein-icon
1 compromised version
- Jun 20, 2022
Malware in @tampmd/utils
1 compromised version
- Jun 20, 2022
Malware in @tampmd/hyperion-ui
1 compromised version
- Jun 20, 2022
Malware in @tampmd/bth-react-components
1 compromised version
Page 7160 of 7,293