Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,563 total · sorted newest first- Jun 20, 2022
Malware in crypto-standarts
1 compromised version
- Jun 20, 2022
Malware in ext-simplexml
1 compromised version
- Jun 20, 2022
Malware in plugin-gd-page-builder-react
1 compromised version
- Jun 20, 2022
Malware in sn-seismic-addons
1 compromised version
- Jun 20, 2022
Malware in gd-garnish
1 compromised version
- Jun 20, 2022
Malicious code in ing-web (npm)
- Jun 20, 2022
Malicious code in ing-open-navigation (npm)
- Jun 20, 2022
Malicious code in @c6bank/diamond (npm)
- Jun 20, 2022
Malware in @c6bank/diamond
1 compromised version
- Jun 20, 2022
Malware in ing-open-navigation
1 compromised version
- Jun 20, 2022
Malware in ing-web
1 compromised version
- Jun 20, 2022
Malicious code in react-nesting-example-modern (npm)
- Jun 20, 2022
Malicious code in postcss-lazy-rules (npm)
- Jun 20, 2022
Malicious code in example-advance (npm)
- Jun 20, 2022
Malicious code in code-oss-dev-build1 (npm)
- Jun 20, 2022
Malicious code in code-oss-dev-build (npm)
- Jun 20, 2022
Malware in example-advance
1 compromised version
- Jun 20, 2022
Malware in code-oss-dev-build
1 compromised version
- Jun 20, 2022
Malware in code-oss-dev-build1
1 compromised version
- Jun 20, 2022
Malware in postcss-lazy-rules
1 compromised version
- Jun 20, 2022
Malware in react-nesting-example-modern
1 compromised version
- Jun 20, 2022
Malicious code in nbaseasons (npm)
- Jun 20, 2022
Malicious code in fitbit-css-loader (npm)
- Jun 20, 2022
Malicious code in dkpusherclient (npm)
- Jun 20, 2022
Malicious code in carousel-enabled (npm)
- Jun 20, 2022
Malware in dkpusherclient
1 compromised version
- Jun 20, 2022
Malware in fitbit-css-loader
1 compromised version
- Jun 20, 2022
Malware in nbaseasons
1 compromised version
- Jun 20, 2022
Malware in carousel-enabled
1 compromised version
- Jun 20, 2022
Malicious code in webhid (npm)
- Jun 20, 2022
Malicious code in thumb-assembler (npm)
- Jun 20, 2022
Malicious code in mbed-js-simple-client (npm)
- Jun 20, 2022
Malicious code in list-loadmore (npm)
- Jun 20, 2022
Malware in mbed-js-simple-client
1 compromised version
- Jun 20, 2022
Malware in list-loadmore
1 compromised version
- Jun 20, 2022
Malware in webhid
1 compromised version
- Jun 20, 2022
Malware in thumb-assembler
1 compromised version
- Jun 20, 2022
Malicious code in angara.tablejs (npm)
- Jun 20, 2022
Malicious code in unresolved (npm)
- Jun 20, 2022
Malicious code in mbed-js-gulp (npm)
- Jun 20, 2022
Malicious code in c3p-test-reactnative (npm)
- Jun 20, 2022
Malware in angara.tablejs
1 compromised version
- Jun 20, 2022
Malware in mbed-js-gulp
1 compromised version
- Jun 20, 2022
Malware in unresolved
1 compromised version
- Jun 20, 2022
Malware in c3p-test-reactnative
1 compromised version
- Jun 20, 2022
Malicious code in angara.serializationjs (npm)
- Jun 20, 2022
Malicious code in angara.chartjs (npm)
- Jun 20, 2022
Malicious code in unodep (npm)
- Jun 20, 2022
Malicious code in test321 (npm)
- Jun 20, 2022
Malware in unodep
1 compromised version
Page 7222 of 7,292