Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,679 total · sorted newest first- Jun 20, 2022
Malicious code in spectrum-arbor (npm)
- Jun 20, 2022
Malicious code in retrieval-components (npm)
- Jun 20, 2022
Malicious code in dig-illustrations (npm)
- Jun 20, 2022
Malicious code in deep-integrations (npm)
- Jun 20, 2022
Malware in deep-integrations
1 compromised version
- Jun 20, 2022
Malware in dig-illustrations
1 compromised version
- Jun 20, 2022
Malware in retrieval-components
1 compromised version
- Jun 20, 2022
Malware in spectrum-arbor
1 compromised version
- Jun 20, 2022
Malicious code in mrg-form (npm)
- Jun 20, 2022
Malicious code in mrg-device-tools (npm)
- Jun 20, 2022
Malicious code in guest-payment (npm)
- Jun 20, 2022
Malicious code in gd-i18n-lib (npm)
- Jun 20, 2022
Malicious code in emerald-vue (npm)
- Jun 20, 2022
Malware in gd-i18n-lib
1 compromised version
- Jun 20, 2022
Malware in emerald-vue
1 compromised version
- Jun 20, 2022
Malware in mrg-form
1 compromised version
- Jun 20, 2022
Malware in guest-payment
1 compromised version
- Jun 20, 2022
Malware in mrg-device-tools
1 compromised version
- Jun 20, 2022
Malicious code in toolkit-common (npm)
- Jun 20, 2022
Malicious code in product-tools (npm)
- Jun 20, 2022
Malicious code in mrg-smokescreen (npm)
- Jun 20, 2022
Malicious code in blocks-cloud (npm)
- Jun 20, 2022
Malware in toolkit-common
1 compromised version
- Jun 20, 2022
Malware in mrg-smokescreen
1 compromised version
- Jun 20, 2022
Malware in blocks-cloud
1 compromised version
- Jun 20, 2022
Malware in product-tools
1 compromised version
- Jun 20, 2022
Malicious code in afisha-guides-landing (npm)
- Jun 20, 2022
Malicious code in tribe-translation (npm)
- Jun 20, 2022
Malicious code in tesla-commerce-ui (npm)
- Jun 20, 2022
Malicious code in richmediacore (npm)
- Jun 20, 2022
Malware in tribe-translation
1 compromised version
- Jun 20, 2022
Malware in richmediacore
1 compromised version
- Jun 20, 2022
Malware in afisha-guides-landing
1 compromised version
- Jun 20, 2022
Malware in tesla-commerce-ui
1 compromised version
- Jun 20, 2022
Malicious code in tribe-api (npm)
- Jun 20, 2022
Malicious code in geoadv-linters (npm)
- Jun 20, 2022
Malicious code in geoadv-app (npm)
- Jun 20, 2022
Malicious code in geoadv-account (npm)
- Jun 20, 2022
Malware in geoadv-linters
1 compromised version
- Jun 20, 2022
Malware in geoadv-app
1 compromised version
- Jun 20, 2022
Malware in tribe-api
1 compromised version
- Jun 20, 2022
Malware in geoadv-account
1 compromised version
- Jun 20, 2022
Malicious code in react-dts-codegen (npm)
- Jun 20, 2022
Malicious code in geoadv-ts-codegen (npm)
- Jun 20, 2022
Malicious code in geoadv-proptypes-codegen (npm)
- Jun 20, 2022
Malicious code in geoadv-entities (npm)
- Jun 20, 2022
Malware in geoadv-entities
1 compromised version
- Jun 20, 2022
Malware in react-dts-codegen
1 compromised version
- Jun 20, 2022
Malware in geoadv-ts-codegen
1 compromised version
- Jun 20, 2022
Malware in geoadv-proptypes-codegen
1 compromised version
Page 7167 of 7,294