Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,472 total · sorted newest first- Jun 20, 2022
Malicious code in epic-ue-themes-la (npm)
- Jun 20, 2022
Malicious code in discord-sniper (npm)
- Jun 20, 2022
Malicious code in cron-guru (npm)
- Jun 20, 2022
Malware in discord-sniper
1 compromised version
- Jun 20, 2022
Malware in node-cron-master1
1 compromised version
- Jun 20, 2022
Malware in cron-guru
1 compromised version
- Jun 20, 2022
Malware in epic-ue-themes-la
1 compromised version
- Jun 20, 2022
Malware in node-cron-master
1 compromised version
- Jun 20, 2022
Malicious code in test-credential (npm)
- Jun 20, 2022
Malicious code in synapse-access-control-1 (npm)
- Jun 20, 2022
Malicious code in shitshit2 (npm)
- Jun 20, 2022
Malware in shitshit2
1 compromised version
- Jun 20, 2022
Malware in synapse-access-control-1
1 compromised version
- Jun 20, 2022
Malware in test-credential
1 compromised version
- Jun 20, 2022
Malicious code in shitshit1 (npm)
- Jun 20, 2022
Malware in shitshit1
1 compromised version
- Jun 20, 2022
Malicious code in shitshit12 (npm)
- Jun 20, 2022
Malicious code in fstreamlalala (npm)
- Jun 20, 2022
Malicious code in fstream-pirlalala (npm)
- Jun 20, 2022
Malicious code in fstream-package-2 (npm)
- Jun 20, 2022
Malware in fstreamlalala
1 compromised version
- Jun 20, 2022
Malware in fstream-pirlalala
1 compromised version
- Jun 20, 2022
Malware in fstream-package-2
1 compromised version
- Jun 20, 2022
Malware in shitshit12
1 compromised version
- Jun 20, 2022
Malicious code in kakakaakaaa11aaa3_returns_hello_jfrog2a (npm)
- Jun 20, 2022
Malicious code in kakakaakaaa11aaa3_returns_hello_jfrog2 (npm)
- Jun 20, 2022
Malicious code in azure-template-cpp (npm)
- Jun 20, 2022
Malicious code in azure-container-registry-samples-ts (npm)
- Jun 20, 2022
Malicious code in azure-container-registry-samples-js (npm)
- Jun 20, 2022
Malware in kakakaakaaa11aaa3_returns_hello_jfrog2a
1 compromised version
- Jun 20, 2022
Malware in azure-template-cpp
1 compromised version
- Jun 20, 2022
Malware in kakakaakaaa11aaa3_returns_hello_jfrog2
1 compromised version
- Jun 20, 2022
Malware in azure-container-registry-samples-ts
1 compromised version
- Jun 20, 2022
Malware in azure-container-registry-samples-js
1 compromised version
- Jun 20, 2022
Malicious code in jobspecification (npm)
- Jun 20, 2022
Malicious code in iotc-migrator (npm)
- Jun 20, 2022
Malicious code in cloudjob (npm)
- Jun 20, 2022
Malicious code in azure-storage-common-cpp (npm)
- Jun 20, 2022
Malware in cloudjob
1 compromised version
- Jun 20, 2022
Malware in iotc-migrator
1 compromised version
- Jun 20, 2022
Malware in azure-storage-common-cpp
1 compromised version
- Jun 20, 2022
Malware in jobspecification
1 compromised version
- Jun 20, 2022
Malicious code in sql-action (npm)
- Jun 20, 2022
Malicious code in kubernetes-ingest (npm)
- Jun 20, 2022
Malicious code in blobindexfunc (npm)
- Jun 20, 2022
Malicious code in apimanagementclient (npm)
- Jun 20, 2022
Malware in kubernetes-ingest
1 compromised version
- Jun 20, 2022
Malware in blobindexfunc
1 compromised version
- Jun 20, 2022
Malware in sql-action
1 compromised version
- Jun 20, 2022
Malware in apimanagementclient
1 compromised version
Page 7240 of 7,290