Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,679 total · sorted newest first- Jun 20, 2022
Malicious code in upchieve-server (npm)
- Jun 20, 2022
Malicious code in sdk-client (npm)
- Jun 20, 2022
Malicious code in msbuild-sdks (npm)
- Jun 20, 2022
Malicious code in kiota-abstractions (npm)
- Jun 20, 2022
Malicious code in karma-cuj-reporter (npm)
- Jun 20, 2022
Malware in upchieve-server
1 compromised version
- Jun 20, 2022
Malware in msbuild-sdks
1 compromised version
- Jun 20, 2022
Malware in kiota-abstractions
1 compromised version
- Jun 20, 2022
Malware in karma-cuj-reporter
1 compromised version
- Jun 20, 2022
Malware in sdk-client
1 compromised version
- Jun 20, 2022
Malicious code in story-editor (npm)
- Jun 20, 2022
Malicious code in pp-vx (npm)
- Jun 20, 2022
Malicious code in karma-failed-tests-reporter (npm)
- Jun 20, 2022
Malicious code in frontend-framework-paypal (npm)
- Jun 20, 2022
Malware in pp-vx
1 compromised version
- Jun 20, 2022
Malware in karma-failed-tests-reporter
1 compromised version
- Jun 20, 2022
Malware in frontend-framework-paypal
1 compromised version
- Jun 20, 2022
Malware in story-editor
1 compromised version
- Jun 20, 2022
Malicious code in @0xten/calc_wzpz618zfk (npm)
- Jun 20, 2022
Malicious code in calc_za9op7a3b4 (npm)
- Jun 20, 2022
Malicious code in calc_wzpz618zfk (npm)
- Jun 20, 2022
Malicious code in calc_9lmhs75x86 (npm)
- Jun 20, 2022
Malware in calc_wzpz618zfk
1 compromised version
- Jun 20, 2022
Malware in calc_9lmhs75x86
1 compromised version
- Jun 20, 2022
Malware in calc_za9op7a3b4
1 compromised version
- Jun 20, 2022
Malware in @0xten/calc_wzpz618zfk
1 compromised version
- Jun 20, 2022
Malicious code in test7458 (npm)
- Jun 20, 2022
Malicious code in stories-carousel (npm)
- Jun 20, 2022
Malicious code in godata (npm)
- Jun 20, 2022
Malicious code in calc_i8wt6fmbwb (npm)
- Jun 20, 2022
Malware in test7458
1 compromised version
- Jun 20, 2022
Malware in stories-carousel
1 compromised version
- Jun 20, 2022
Malware in calc_i8wt6fmbwb
1 compromised version
- Jun 20, 2022
Malware in godata
1 compromised version
- Jun 20, 2022
Malicious code in @answers/exp-id-tools (npm)
- Jun 20, 2022
Malicious code in @aadiam/ibiza-search (npm)
- Jun 20, 2022
Malicious code in native-utils (npm)
- Jun 20, 2022
Malicious code in @exness/select-component-ab (npm)
- Jun 20, 2022
Malware in @answers/exp-id-tools
1 compromised version
- Jun 20, 2022
Malware in native-utils
1 compromised version
- Jun 20, 2022
Malware in @exness/select-component-ab
1 compromised version
- Jun 20, 2022
Malware in @aadiam/ibiza-search
1 compromised version
- Jun 20, 2022
Malicious code in relap-widgets (npm)
- Jun 20, 2022
Malicious code in relap-ui (npm)
- Jun 20, 2022
Malicious code in @relap/kit (npm)
- Jun 20, 2022
Malicious code in dig-fonts (npm)
- Jun 20, 2022
Malware in dig-fonts
1 compromised version
- Jun 20, 2022
Malware in @relap/kit
1 compromised version
- Jun 20, 2022
Malware in relap-ui
1 compromised version
- Jun 20, 2022
Malware in relap-widgets
1 compromised version
Page 7166 of 7,294