Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,553 total · sorted newest first- Jun 20, 2022
Malware in node-colors-sync
1 compromised version
- Jun 20, 2022
Malicious code in nfe-kampanje-react (npm)
- Jun 20, 2022
Malicious code in mobilbank-communication (npm)
- Jun 20, 2022
Malicious code in eslint-config-ffe (npm)
- Jun 20, 2022
Malicious code in antisvindel (npm)
- Jun 20, 2022
Malware in nfe-kampanje-react
1 compromised version
- Jun 20, 2022
Malware in eslint-config-ffe
1 compromised version
- Jun 20, 2022
Malware in antisvindel
1 compromised version
- Jun 20, 2022
Malware in mobilbank-communication
1 compromised version
- Jun 20, 2022
Malicious code in virtual-npm-lyft (npm)
- Jun 20, 2022
Malicious code in ride-mode-selector (npm)
- Jun 20, 2022
Malicious code in nfe-splunk-analytics (npm)
- Jun 20, 2022
Malicious code in eslint-config-ffe-base (npm)
- Jun 20, 2022
Malware in ride-mode-selector
1 compromised version
- Jun 20, 2022
Malware in virtual-npm-lyft
1 compromised version
- Jun 20, 2022
Malware in nfe-splunk-analytics
1 compromised version
- Jun 20, 2022
Malware in eslint-config-ffe-base
1 compromised version
- Jun 20, 2022
Malicious code in accessibility-insights-action (npm)
- Jun 20, 2022
Malicious code in lyft-service-plugin-service-client (npm)
- Jun 20, 2022
Malicious code in internal_pkg_dc_lib (npm)
- Jun 20, 2022
Malicious code in carbon-localization (npm)
- Jun 20, 2022
Malware in accessibility-insights-action
1 compromised version
- Jun 20, 2022
Malware in carbon-localization
1 compromised version
- Jun 20, 2022
Malware in internal_pkg_dc_lib
1 compromised version
- Jun 20, 2022
Malware in lyft-service-plugin-service-client
1 compromised version
- Jun 20, 2022
Malicious code in testpackagehere (npm)
- Jun 20, 2022
Malicious code in netlify-swag (npm)
- Jun 20, 2022
Malicious code in netlify-build (npm)
- Jun 20, 2022
Malicious code in ds-club (npm)
- Jun 20, 2022
Malware in netlify-build
1 compromised version
- Jun 20, 2022
Malware in ds-club
1 compromised version
- Jun 20, 2022
Malware in netlify-swag
1 compromised version
- Jun 20, 2022
Malware in testpackagehere
1 compromised version
- Jun 20, 2022
Malicious code in 0-dns (npm)
- Jun 20, 2022
Malicious code in ws-gp-security-action (npm)
- Jun 20, 2022
Malicious code in shubhtestingit (npm)
- Jun 20, 2022
Malicious code in focal-manual-tests (npm)
- Jun 20, 2022
Malware in ws-gp-security-action
1 compromised version
- Jun 20, 2022
Malware in 0-dns
1 compromised version
- Jun 20, 2022
Malware in shubhtestingit
1 compromised version
- Jun 20, 2022
Malware in focal-manual-tests
1 compromised version
- Jun 20, 2022
Malicious code in adaptivecards-designer-app (npm)
- Jun 20, 2022
Malicious code in qs-state-visualizer (npm)
- Jun 20, 2022
Malicious code in panther-github-actions (npm)
- Jun 20, 2022
Malicious code in mattermost-oauth2-client-sample-app (npm)
- Jun 20, 2022
Malicious code in encryptte-test (npm)
- Jun 20, 2022
Malware in encryptte-test
1 compromised version
- Jun 20, 2022
Malware in qs-state-visualizer
1 compromised version
- Jun 20, 2022
Malware in panther-github-actions
1 compromised version
- Jun 20, 2022
Malware in mattermost-oauth2-client-sample-app
1 compromised version
Page 7226 of 7,292