Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,595 total · sorted newest first- Jun 20, 2022
Malicious code in h98dxxx (npm)
- Jun 20, 2022
Malware in h98dxxx
1 compromised version
- Jun 20, 2022
Malicious code in phone_helpers (npm)
- Jun 20, 2022
Malicious code in hydrogen-playground (npm)
- Jun 20, 2022
Malicious code in h98dxx (npm)
- Jun 20, 2022
Malicious code in h98dx (npm)
- Jun 20, 2022
Malware in hydrogen-playground
1 compromised version
- Jun 20, 2022
Malware in phone_helpers
1 compromised version
- Jun 20, 2022
Malware in h98dx
1 compromised version
- Jun 20, 2022
Malware in h98dxx
1 compromised version
- Jun 20, 2022
Malicious code in weather-power-up (npm)
- Jun 20, 2022
Malicious code in react-devtools-timeline (npm)
- Jun 20, 2022
Malicious code in react-devtools-shell (npm)
- Jun 20, 2022
Malicious code in js_oauth_token (npm)
- Jun 20, 2022
Malware in react-devtools-shell
1 compromised version
- Jun 20, 2022
Malware in react-devtools-timeline
1 compromised version
- Jun 20, 2022
Malware in js_oauth_token
1 compromised version
- Jun 20, 2022
Malware in weather-power-up
1 compromised version
- Jun 20, 2022
Malicious code in mapbox-search-ios (npm)
- Jun 20, 2022
Malicious code in go-pro-demo-ionic3 (npm)
- Jun 20, 2022
Malicious code in blockchain-wallet-v4-frontend (npm)
- Jun 20, 2022
Malicious code in bbmodules (npm)
- Jun 20, 2022
Malware in blockchain-wallet-v4-frontend
1 compromised version
- Jun 20, 2022
Malware in go-pro-demo-ionic3
1 compromised version
- Jun 20, 2022
Malware in mapbox-search-ios
1 compromised version
- Jun 20, 2022
Malware in bbmodules
1 compromised version
- Jun 20, 2022
Malicious code in react-redux-next (npm)
- Jun 20, 2022
Malicious code in @primeo/platform (npm)
- Jun 20, 2022
Malicious code in @primeo/notifier (npm)
- Jun 20, 2022
Malicious code in @primeo/layouts (npm)
- Jun 20, 2022
Malicious code in @primeo/common (npm)
- Jun 20, 2022
Malware in react-redux-next
1 compromised version
- Jun 20, 2022
Malware in @primeo/platform
1 compromised version
- Jun 20, 2022
Malware in @primeo/layouts
1 compromised version
- Jun 20, 2022
Malware in @primeo/notifier
1 compromised version
- Jun 20, 2022
Malware in @primeo/common
1 compromised version
- Jun 20, 2022
Malicious code in @primeo/shell (npm)
- Jun 20, 2022
Malicious code in @primeo/components (npm)
- Jun 20, 2022
Malicious code in @primeo/authentication (npm)
- Jun 20, 2022
Malware in @primeo/components
1 compromised version
- Jun 20, 2022
Malware in @primeo/authentication
1 compromised version
- Jun 20, 2022
Malware in @primeo/shell
1 compromised version
- Jun 20, 2022
Malicious code in @primeo/scs-compiler (npm)
- Jun 20, 2022
Malicious code in @primeo/page-info (npm)
- Jun 20, 2022
Malicious code in @primeo/analytics (npm)
- Jun 20, 2022
Malicious code in @primeo/address (npm)
- Jun 20, 2022
Malware in @primeo/scs-compiler
1 compromised version
- Jun 20, 2022
Malware in @primeo/page-info
1 compromised version
- Jun 20, 2022
Malware in @primeo/analytics
1 compromised version
- Jun 20, 2022
Malware in @primeo/address
1 compromised version
Page 7206 of 7,292