Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Jun 20, 2022
Malware in bitski-js
1 compromised version
- Jun 20, 2022
Malware in hitta-partner-controls
1 compromised version
- Jun 20, 2022
Malware in whitesourcepublisher
1 compromised version
- Jun 20, 2022
Malware in belvo-integration-api
1 compromised version
- Jun 20, 2022
Malicious code in reveal-js-multiplex (npm)
- Jun 20, 2022
Malicious code in polymesh-scripts (npm)
- Jun 20, 2022
Malicious code in polymesh-docs (npm)
- Jun 20, 2022
Malicious code in polymesh-cli (npm)
- Jun 20, 2022
Malicious code in countdown-context (npm)
- Jun 20, 2022
Malware in polymesh-docs
1 compromised version
- Jun 20, 2022
Malware in polymesh-scripts
1 compromised version
- Jun 20, 2022
Malware in polymesh-cli
1 compromised version
- Jun 20, 2022
Malware in reveal-js-multiplex
1 compromised version
- Jun 20, 2022
Malware in countdown-context
1 compromised version
- Jun 20, 2022
Malicious code in ping-on-pr (npm)
- Jun 20, 2022
Malicious code in patreon-examples (npm)
- Jun 20, 2022
Malicious code in ginnyinanpm (npm)
- Jun 20, 2022
Malware in ginnyinanpm
1 compromised version
- Jun 20, 2022
Malware in patreon-examples
1 compromised version
- Jun 20, 2022
Malware in ping-on-pr
1 compromised version
- Jun 20, 2022
Malicious code in workpentestvirus (npm)
- Jun 20, 2022
Malicious code in serverless-yandex-cloud-template (npm)
- Jun 20, 2022
Malicious code in selfbotdiv (npm)
- Jun 20, 2022
Malicious code in parrot-skill (npm)
- Jun 20, 2022
Malicious code in @omega-tracker/omg-abstract-strategy-plugin (npm)
- Jun 20, 2022
Malicious code in ml-handbook (npm)
- Jun 20, 2022
Malicious code in miniapp-api (npm)
- Jun 20, 2022
Malicious code in mimlofy-creator (npm)
- Jun 20, 2022
Malicious code in discordcod (npm)
- Jun 20, 2022
Malware in ml-handbook
1 compromised version
- Jun 20, 2022
Malware in miniapp-api
1 compromised version
- Jun 20, 2022
Malware in selfbotdiv
1 compromised version
- Jun 20, 2022
Malware in serverless-yandex-cloud-template
1 compromised version
- Jun 20, 2022
Malware in mimlofy-creator
1 compromised version
- Jun 20, 2022
Malware in parrot-skill
1 compromised version
- Jun 20, 2022
Malware in discordcod
1 compromised version
- Jun 20, 2022
Malware in @omega-tracker/omg-abstract-strategy-plugin
1 compromised version
- Jun 20, 2022
Malware in workpentestvirus
1 compromised version
- Jun 20, 2022
Malicious code in nginx-data-transfer-parser (npm)
- Jun 20, 2022
Malicious code in ember-sample (npm)
- Jun 20, 2022
Malicious code in commit-changes (npm)
- Jun 20, 2022
Malicious code in argocd-diff-action (npm)
- Jun 20, 2022
Malware in argocd-diff-action
1 compromised version
- Jun 20, 2022
Malware in commit-changes
1 compromised version
- Jun 20, 2022
Malware in nginx-data-transfer-parser
1 compromised version
- Jun 20, 2022
Malware in ember-sample
1 compromised version
- Jun 20, 2022
Malicious code in selfservicedesk-client (npm)
- Jun 20, 2022
Malicious code in basubanakar (npm)
- Jun 20, 2022
Malware in basubanakar
1 compromised version
- Jun 20, 2022
Malware in selfservicedesk-client
1 compromised version
Page 7205 of 7,293