Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,678 total · sorted newest first- Jun 20, 2022
Malicious code in bem-xjst-static-analyzer (npm)
- Jun 20, 2022
Malicious code in auction2-im (npm)
- Jun 20, 2022
Malicious code in auction2-assets (npm)
- Jun 20, 2022
Malware in staff-card
1 compromised version
- Jun 20, 2022
Malware in auction2-assets
1 compromised version
- Jun 20, 2022
Malware in auction2-im
1 compromised version
- Jun 20, 2022
Malware in bem-xjst-static-analyzer
1 compromised version
- Jun 20, 2022
Malicious code in user-interface-kit (npm)
- Jun 20, 2022
Malicious code in @fbsystem/figma-messenger (npm)
- Jun 20, 2022
Malicious code in @fbsystem/figma-intern-shell (npm)
- Jun 20, 2022
Malicious code in @fbpay/sdk (npm)
- Jun 20, 2022
Malware in @fbsystem/figma-messenger
1 compromised version
- Jun 20, 2022
Malware in user-interface-kit
1 compromised version
- Jun 20, 2022
Malware in @fbsystem/figma-intern-shell
1 compromised version
- Jun 20, 2022
Malware in @fbpay/sdk
1 compromised version
- Jun 20, 2022
Malicious code in moodules (npm)
- Jun 20, 2022
Malicious code in @fbsystem/figma-graphql (npm)
- Jun 20, 2022
Malicious code in @fbpay/test-container-utils (npm)
- Jun 20, 2022
Malicious code in @fbpay/merchant-demo (npm)
- Jun 20, 2022
Malware in @fbpay/merchant-demo
1 compromised version
- Jun 20, 2022
Malware in @fbpay/test-container-utils
1 compromised version
- Jun 20, 2022
Malware in @fbsystem/figma-graphql
1 compromised version
- Jun 20, 2022
Malware in moodules
1 compromised version
- Jun 20, 2022
Malicious code in test-container-utils (npm)
- Jun 20, 2022
Malicious code in igrepoposide (npm)
- Jun 20, 2022
Malicious code in figma-intern-shell (npm)
- Jun 20, 2022
Malicious code in anpgvytdohnmusxxexicyoojcrmmzvartwuisqqtnaqolfyddhcfkpnrncyc (npm)
- Jun 20, 2022
Malware in figma-intern-shell
1 compromised version
- Jun 20, 2022
Malware in test-container-utils
1 compromised version
- Jun 20, 2022
Malware in igrepoposide
1 compromised version
- Jun 20, 2022
Malware in anpgvytdohnmusxxexicyoojcrmmzvartwuisqqtnaqolfyddhcfkpnrncyc
1 compromised version
- Jun 20, 2022
Malicious code in plugin-typings (npm)
- Jun 20, 2022
Malicious code in generatedloggerutils (npm)
- Jun 20, 2022
Malicious code in figma-scripts (npm)
- Jun 20, 2022
Malicious code in fb-arcanist-rpc (npm)
- Jun 20, 2022
Malicious code in dependency-from-npm (npm)
- Jun 20, 2022
Malware in dependency-from-npm
1 compromised version
- Jun 20, 2022
Malware in plugin-typings
1 compromised version
- Jun 20, 2022
Malware in generatedloggerutils
1 compromised version
- Jun 20, 2022
Malware in figma-scripts
1 compromised version
- Jun 20, 2022
Malware in fb-arcanist-rpc
1 compromised version
- Jun 20, 2022
Malicious code in nuclide-marshalers-client (npm)
- Jun 20, 2022
Malicious code in @maalik/logger (npm)
- Jun 20, 2022
Malicious code in fb-graphql-compiler (npm)
- Jun 20, 2022
Malicious code in express-checkout-sdk (npm)
- Jun 20, 2022
Malware in nuclide-marshalers-client
1 compromised version
- Jun 20, 2022
Malware in fb-graphql-compiler
1 compromised version
- Jun 20, 2022
Malware in @maalik/logger
1 compromised version
- Jun 20, 2022
Malware in express-checkout-sdk
1 compromised version
- Jun 20, 2022
Malicious code in p2p-amount-field (npm)
Page 7168 of 7,294