Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,619 total · sorted newest first- Jun 20, 2022
Malicious code in usaa-url-manager (npm)
- Jun 20, 2022
Malicious code in usaa-messaging (npm)
- Jun 20, 2022
Malicious code in usaa-accessible-text (npm)
- Jun 20, 2022
Malicious code in @mcm-schema/valaution-service (npm)
- Jun 20, 2022
Malware in usaa-messaging
1 compromised version
- Jun 20, 2022
Malware in @mcm-schema/valaution-service
1 compromised version
- Jun 20, 2022
Malware in usaa-accessible-text
1 compromised version
- Jun 20, 2022
Malware in usaa-url-manager
1 compromised version
- Jun 20, 2022
Malicious code in test-proj-for-myself (npm)
- Jun 20, 2022
Malicious code in tazata (npm)
- Jun 20, 2022
Malicious code in ok-messenger-model (npm)
- Jun 20, 2022
Malicious code in music-ui (npm)
- Jun 20, 2022
Malicious code in covisint (npm)
- Jun 20, 2022
Malware in tazata
1 compromised version
- Jun 20, 2022
Malware in ok-messenger-model
1 compromised version
- Jun 20, 2022
Malware in music-ui
1 compromised version
- Jun 20, 2022
Malware in covisint
1 compromised version
- Jun 20, 2022
Malware in test-proj-for-myself
1 compromised version
- Jun 20, 2022
Malicious code in xyz-maps-core (npm)
- Jun 20, 2022
Malicious code in wb-dev-build-settings (npm)
- Jun 20, 2022
Malicious code in safehaven-sdk (npm)
- Jun 20, 2022
Malicious code in buy-button-storefront (npm)
- Jun 20, 2022
Malware in wb-dev-build-settings
1 compromised version
- Jun 20, 2022
Malware in buy-button-storefront
1 compromised version
- Jun 20, 2022
Malware in safehaven-sdk
1 compromised version
- Jun 20, 2022
Malware in xyz-maps-core
1 compromised version
- Jun 20, 2022
Malicious code in scheduler-0-13 (npm)
- Jun 20, 2022
Malicious code in osa-tool (npm)
- Jun 20, 2022
Malicious code in mocha-junit-reporters-2 (npm)
- Jun 20, 2022
Malicious code in calc_85n2frdx2j (npm)
- Jun 20, 2022
Malware in scheduler-0-13
1 compromised version
- Jun 20, 2022
Malware in calc_85n2frdx2j
1 compromised version
- Jun 20, 2022
Malware in osa-tool
1 compromised version
- Jun 20, 2022
Malware in mocha-junit-reporters-2
1 compromised version
- Jun 20, 2022
Malicious code in rawspec (npm)
- Jun 20, 2022
Malicious code in ethereum-abi (npm)
- Jun 20, 2022
Malicious code in calc_ucadidayug (npm)
- Jun 20, 2022
Malicious code in calc_rsrj6q3yhl (npm)
- Jun 20, 2022
Malware in calc_ucadidayug
1 compromised version
- Jun 20, 2022
Malware in calc_rsrj6q3yhl
1 compromised version
- Jun 20, 2022
Malware in ethereum-abi
1 compromised version
- Jun 20, 2022
Malware in rawspec
1 compromised version
- Jun 20, 2022
Malicious code in resize-observe (npm)
- Jun 20, 2022
Malicious code in pakistan_hsudoaps (npm)
- Jun 20, 2022
Malicious code in ohbhee (npm)
- Jun 20, 2022
Malicious code in lint-staged-var (npm)
- Jun 20, 2022
Malicious code in jhoolay (npm)
- Jun 20, 2022
Malware in pakistan_hsudoaps
1 compromised version
- Jun 20, 2022
Malware in resize-observe
1 compromised version
- Jun 20, 2022
Malware in jhoolay
1 compromised version
Page 7161 of 7,293