Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,560 total · sorted newest first- Jun 20, 2022
Malicious code in react-native-fido-login-api (npm)
- Jun 20, 2022
Malicious code in makerjs-wrap-text (npm)
- Jun 20, 2022
Malicious code in ganache-core-coverage (npm)
- Jun 20, 2022
Malicious code in full-stack-recruitment-test (npm)
- Jun 20, 2022
Malware in react-native-fido-login-api
1 compromised version
- Jun 20, 2022
Malware in makerjs-wrap-text
1 compromised version
- Jun 20, 2022
Malware in full-stack-recruitment-test
1 compromised version
- Jun 20, 2022
Malware in ganache-core-coverage
1 compromised version
- Jun 20, 2022
Malicious code in ext-iconv-test1 (npm)
- Jun 20, 2022
Malicious code in ext-iconv-test-3 (npm)
- Jun 20, 2022
Malicious code in ext-iconv-test (npm)
- Jun 20, 2022
Malicious code in @eg-maps/commons (npm)
- Jun 20, 2022
Malware in @eg-maps/commons
1 compromised version
- Jun 20, 2022
Malware in ext-iconv-test-3
1 compromised version
- Jun 20, 2022
Malware in ext-iconv-test
1 compromised version
- Jun 20, 2022
Malware in ext-iconv-test1
1 compromised version
- Jun 20, 2022
Malicious code in netlify-testing-stuff (npm)
- Jun 20, 2022
Malicious code in gd-apm (npm)
- Jun 20, 2022
Malicious code in discord.js-discord-selfbot-v4 (npm)
- Jun 20, 2022
Malicious code in colors-beta (npm)
- Jun 20, 2022
Malware in gd-apm
1 compromised version
- Jun 20, 2022
Malware in discord.js-discord-selfbot-v4
1 compromised version
- Jun 20, 2022
Malware in colors-beta
1 compromised version
- Jun 20, 2022
Malware in netlify-testing-stuff
1 compromised version
- Jun 20, 2022
Malicious code in ui-component-icon (npm)
- Jun 20, 2022
Malicious code in mailru-toolkit-lego-bundle (npm)
- Jun 20, 2022
Malicious code in gd-seo-central (npm)
- Jun 20, 2022
Malicious code in gd-eslint (npm)
- Jun 20, 2022
Malware in mailru-toolkit-lego-bundle
1 compromised version
- Jun 20, 2022
Malware in ui-component-icon
1 compromised version
- Jun 20, 2022
Malware in gd-eslint
1 compromised version
- Jun 20, 2022
Malware in gd-seo-central
1 compromised version
- Jun 20, 2022
Malicious code in airbnb-fejax (npm)
- Jun 20, 2022
Malicious code in pp-amount-field (npm)
- Jun 20, 2022
Malicious code in cross.project.dnd (npm)
- Jun 20, 2022
Malicious code in botbait (npm)
- Jun 20, 2022
Malicious code in apparel-sizechart-web-lib (npm)
- Jun 20, 2022
Malware in botbait
1 compromised version
- Jun 20, 2022
Malware in apparel-sizechart-web-lib
1 compromised version
- Jun 20, 2022
Malware in pp-amount-field
1 compromised version
- Jun 20, 2022
Malware in airbnb-fejax
1 compromised version
- Jun 20, 2022
Malware in cross.project.dnd
1 compromised version
- Jun 20, 2022
Malicious code in dabu-pixel-handler (npm)
- Jun 20, 2022
Malicious code in cpg-nordic (npm)
- Jun 20, 2022
Malicious code in cap-brand (npm)
- Jun 20, 2022
Malicious code in browser-wurfl (npm)
- Jun 20, 2022
Malware in cpg-nordic
1 compromised version
- Jun 20, 2022
Malware in cap-brand
1 compromised version
- Jun 20, 2022
Malware in browser-wurfl
1 compromised version
- Jun 20, 2022
Malware in dabu-pixel-handler
1 compromised version
Page 7224 of 7,292