Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,533 total · sorted newest first- Jun 20, 2022
Malware in wechat-rn
1 compromised version
- Jun 20, 2022
Malware in alicloud-js-sdk
1 compromised version
- Jun 20, 2022
Malware in wechat-mobile
1 compromised version
- Jun 20, 2022
Malicious code in tencent-js-sdk (npm)
- Jun 20, 2022
Malicious code in protobufjs-databricks (npm)
- Jun 20, 2022
Malicious code in pingan-js-sdk (npm)
- Jun 20, 2022
Malicious code in lenovo-js-sdk (npm)
- Jun 20, 2022
Malware in protobufjs-databricks
1 compromised version
- Jun 20, 2022
Malware in tencent-js-sdk
1 compromised version
- Jun 20, 2022
Malware in lenovo-js-sdk
1 compromised version
- Jun 20, 2022
Malware in pingan-js-sdk
1 compromised version
- Jun 20, 2022
Malicious code in spark-pr-board (npm)
- Jun 20, 2022
Malicious code in helloadmin (npm)
- Jun 20, 2022
Malicious code in dpgs (npm)
- Jun 20, 2022
Malicious code in coupa-common-js (npm)
- Jun 20, 2022
Malware in helloadmin
1 compromised version
- Jun 20, 2022
Malware in dpgs
1 compromised version
- Jun 20, 2022
Malware in coupa-common-js
1 compromised version
- Jun 20, 2022
Malware in spark-pr-board
1 compromised version
- Jun 20, 2022
Malicious code in skfb-viewer-protocol (npm)
- Jun 20, 2022
Malicious code in @sravni/oh-my-got (npm)
- Jun 20, 2022
Malicious code in @ozon-bx/ui-components (npm)
- Jun 20, 2022
Malicious code in maps-theme (npm)
- Jun 20, 2022
Malware in skfb-viewer-protocol
1 compromised version
- Jun 20, 2022
Malware in @ozon-bx/ui-components
1 compromised version
- Jun 20, 2022
Malware in maps-theme
1 compromised version
- Jun 20, 2022
Malware in @sravni/oh-my-got
1 compromised version
- Jun 20, 2022
Malicious code in yahoo-react-select-box (npm)
- Jun 20, 2022
Malicious code in oh-my-got (npm)
- Jun 20, 2022
Malicious code in kakakaakaaa11aaa3 (npm)
- Jun 20, 2022
Malicious code in cschandragirisample (npm)
- Jun 20, 2022
Malware in kakakaakaaa11aaa3
1 compromised version
- Jun 20, 2022
Malware in yahoo-react-select-box
1 compromised version
- Jun 20, 2022
Malware in oh-my-got
1 compromised version
- Jun 20, 2022
Malware in cschandragirisample
1 compromised version
- Jun 20, 2022
Malicious code in angieslist-styleguide (npm)
- Jun 20, 2022
Malicious code in saddlebag-events (npm)
- Jun 20, 2022
Malicious code in ringrtc (npm)
- Jun 20, 2022
Malicious code in pf-web-build (npm)
- Jun 20, 2022
Malicious code in pcln-config (npm)
- Jun 20, 2022
Malware in ringrtc
1 compromised version
- Jun 20, 2022
Malware in pcln-config
1 compromised version
- Jun 20, 2022
Malware in angieslist-styleguide
1 compromised version
- Jun 20, 2022
Malware in pf-web-build
1 compromised version
- Jun 20, 2022
Malware in saddlebag-events
1 compromised version
- Jun 20, 2022
Malicious code in fake_la (npm)
- Jun 20, 2022
Malicious code in chainlink-qtum (npm)
- Jun 20, 2022
Malicious code in api-microsoft (npm)
- Jun 20, 2022
Malware in api-microsoft
1 compromised version
- Jun 20, 2022
Malware in fake_la
1 compromised version
Page 7229 of 7,291