Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Jun 20, 2022
Malware in @ta-web-platform/localezone
1 compromised version
- Jun 20, 2022
Malware in @status-waku-voting/contracts
1 compromised version
- Jun 20, 2022
Malware in @webexts/build-utils
1 compromised version
- Jun 20, 2022
Malware in @status-waku-voting/core
1 compromised version
- Jun 20, 2022
Malicious code in @app-services-components/usedomlocation (npm)
- Jun 20, 2022
Malicious code in noderevshell (npm)
- Jun 20, 2022
Malicious code in module-with-node-file (npm)
- Jun 20, 2022
Malicious code in @dier-makr/inversify (npm)
- Jun 20, 2022
Malware in module-with-node-file
1 compromised version
- Jun 20, 2022
Malware in noderevshell
1 compromised version
- Jun 20, 2022
Malware in @dier-makr/inversify
1 compromised version
- Jun 20, 2022
Malware in @app-services-components/usedomlocation
1 compromised version
- Jun 20, 2022
Malicious code in tispack (npm)
- Jun 20, 2022
Malicious code in octavius-public (npm)
- Jun 20, 2022
Malicious code in electron-secure-defaults (npm)
- Jun 20, 2022
Malicious code in bitgowalletrecoverywizard (npm)
- Jun 20, 2022
Malware in octavius-public
1 compromised version
- Jun 20, 2022
Malware in tispack
1 compromised version
- Jun 20, 2022
Malware in electron-secure-defaults
1 compromised version
- Jun 20, 2022
Malware in bitgowalletrecoverywizard
1 compromised version
- Jun 20, 2022
Malicious code in wayfair.github.io (npm)
- Jun 20, 2022
Malicious code in minimal-mistakes (npm)
- Jun 20, 2022
Malicious code in com.tunnelbear.blocker (npm)
- Jun 20, 2022
Malicious code in clever-goals-js (npm)
- Jun 20, 2022
Malware in clever-goals-js
1 compromised version
- Jun 20, 2022
Malware in minimal-mistakes
1 compromised version
- Jun 20, 2022
Malware in com.tunnelbear.blocker
1 compromised version
- Jun 20, 2022
Malware in wayfair.github.io
1 compromised version
- Jun 20, 2022
Malicious code in zoe-sketchbook (npm)
- Jun 20, 2022
Malicious code in webhook-provisioner (npm)
- Jun 20, 2022
Malicious code in updated-object-diff (npm)
- Jun 20, 2022
Malicious code in gltestp (npm)
- Jun 20, 2022
Malicious code in gatsby-remark-gifplayer-transformer (npm)
- Jun 20, 2022
Malware in webhook-provisioner
1 compromised version
- Jun 20, 2022
Malware in gltestp
1 compromised version
- Jun 20, 2022
Malware in updated-object-diff
1 compromised version
- Jun 20, 2022
Malware in gatsby-remark-gifplayer-transformer
1 compromised version
- Jun 20, 2022
Malware in zoe-sketchbook
1 compromised version
- Jun 20, 2022
Malicious code in yarn-design-system-react-select (npm)
- Jun 20, 2022
Malicious code in yarn-design-system-flatpickr (npm)
- Jun 20, 2022
Malicious code in yarn-design-system-choicesjs-stencil (npm)
- Jun 20, 2022
Malicious code in fetchspec (npm)
- Jun 20, 2022
Malware in fetchspec
1 compromised version
- Jun 20, 2022
Malware in yarn-design-system-flatpickr
1 compromised version
- Jun 20, 2022
Malware in yarn-design-system-react-select
1 compromised version
- Jun 20, 2022
Malware in yarn-design-system-choicesjs-stencil
1 compromised version
- Jun 20, 2022
Malicious code in yarn-design-system-rc-tooltip (npm)
- Jun 20, 2022
Malicious code in yarn-design-system-rc-input-number (npm)
- Jun 20, 2022
Malicious code in yarn-design-system-fonts (npm)
- Jun 20, 2022
Malware in yarn-design-system-rc-input-number
1 compromised version
Page 7200 of 7,293