Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,552 total · sorted newest first- Jun 20, 2022
Malicious code in vue-docs-image-recognition (npm)
- Jun 20, 2022
Malicious code in rm-deployment-status-enhancer-tab (npm)
- Jun 20, 2022
Malicious code in msal-react-quickstart (npm)
- Jun 20, 2022
Malicious code in focal-todomvc (npm)
- Jun 20, 2022
Malware in vue-docs-image-recognition
1 compromised version
- Jun 20, 2022
Malware in rm-deployment-status-enhancer-tab
1 compromised version
- Jun 20, 2022
Malware in focal-todomvc
1 compromised version
- Jun 20, 2022
Malware in msal-react-quickstart
1 compromised version
- Jun 20, 2022
Malicious code in pingone-angular-registration (npm)
- Jun 20, 2022
Malicious code in launcher-start-page (npm)
- Jun 20, 2022
Malicious code in elastic-apm-rum (npm)
- Jun 20, 2022
Malware in pingone-angular-registration
1 compromised version
- Jun 20, 2022
Malware in elastic-apm-rum
1 compromised version
- Jun 20, 2022
Malware in launcher-start-page
1 compromised version
- Jun 20, 2022
Malicious code in ing-orange-login-sca-es (npm)
- Jun 20, 2022
Malicious code in ing-app-login-sca-es (npm)
- Jun 20, 2022
Malicious code in @idse/core (npm)
- Jun 20, 2022
Malicious code in @idse/common-ui (npm)
- Jun 20, 2022
Malware in ing-app-login-sca-es
1 compromised version
- Jun 20, 2022
Malware in @idse/common-ui
1 compromised version
- Jun 20, 2022
Malware in ing-orange-login-sca-es
1 compromised version
- Jun 20, 2022
Malware in @idse/core
1 compromised version
- Jun 20, 2022
Malicious code in yelp-react-component-ynra (npm)
- Jun 20, 2022
Malicious code in pj-reporting-frontend (npm)
- Jun 20, 2022
Malicious code in ing.app.transactional (npm)
- Jun 20, 2022
Malicious code in imodel-query-agent (npm)
- Jun 20, 2022
Malware in pj-reporting-frontend
1 compromised version
- Jun 20, 2022
Malware in yelp-react-component-ynra
1 compromised version
- Jun 20, 2022
Malware in imodel-query-agent
1 compromised version
- Jun 20, 2022
Malware in ing.app.transactional
1 compromised version
- Jun 20, 2022
Malicious code in wgversion (npm)
- Jun 20, 2022
Malicious code in three-d-secure (npm)
- Jun 20, 2022
Malicious code in siteversion (npm)
- Jun 20, 2022
Malicious code in local-payment (npm)
- Jun 20, 2022
Malware in local-payment
1 compromised version
- Jun 20, 2022
Malware in wgversion
1 compromised version
- Jun 20, 2022
Malware in siteversion
1 compromised version
- Jun 20, 2022
Malware in three-d-secure
1 compromised version
- Jun 20, 2022
Malicious code in yelp-react-component-photo-box (npm)
- Jun 20, 2022
Malicious code in yelp-biz-action-constants (npm)
- Jun 20, 2022
Malicious code in yahoo-react-pillbox (npm)
- Jun 20, 2022
Malicious code in yahoo-react-multi-select-box (npm)
- Jun 20, 2022
Malware in yahoo-react-pillbox
1 compromised version
- Jun 20, 2022
Malware in yelp-react-component-photo-box
1 compromised version
- Jun 20, 2022
Malware in yelp-biz-action-constants
1 compromised version
- Jun 20, 2022
Malware in yahoo-react-multi-select-box
1 compromised version
- Jun 20, 2022
Malicious code in project-with-joe (npm)
- Jun 20, 2022
Malicious code in deps-json-webpack-plugin (npm)
- Jun 20, 2022
Malicious code in dellingr (npm)
- Jun 20, 2022
Malicious code in @bugbounty-automation/deps-json-webpack-plugin (npm)
Page 7227 of 7,292