Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,429 total · sorted newest first- Jun 20, 2022
Malicious code in smithy-client (npm)
- Jun 20, 2022
Malicious code in protocol-http (npm)
- Jun 20, 2022
Malicious code in middleware-user-agent (npm)
- Jun 20, 2022
Malware in smithy-client
1 compromised version
- Jun 20, 2022
Malware in protocol-http
1 compromised version
- Jun 20, 2022
Malware in url-parser-native
1 compromised version
- Jun 20, 2022
Malware in middleware-user-agent
1 compromised version
- Jun 20, 2022
Malicious code in oas-nodegen (npm)
- Jun 20, 2022
Malicious code in node-config-provider (npm)
- Jun 20, 2022
Malicious code in mbed-connector (npm)
- Jun 20, 2022
Malicious code in ignored-package-pkg-a (npm)
- Jun 20, 2022
Malware in oas-nodegen
1 compromised version
- Jun 20, 2022
Malware in node-config-provider
1 compromised version
- Jun 20, 2022
Malware in mbed-connector
1 compromised version
- Jun 20, 2022
Malware in ignored-package-pkg-a
1 compromised version
- Jun 20, 2022
Malicious code in whistle-start (npm)
- Jun 20, 2022
Malicious code in matic-protocol (npm)
- Jun 20, 2022
Malicious code in iv-node-fetch (npm)
- Jun 20, 2022
Malicious code in iv-gtin-utils (npm)
- Jun 20, 2022
Malicious code in iv-build-utils (npm)
- Jun 20, 2022
Malware in matic-protocol
1 compromised version
- Jun 20, 2022
Malware in whistle-start
1 compromised version
- Jun 20, 2022
Malware in iv-gtin-utils
1 compromised version
- Jun 20, 2022
Malware in iv-node-fetch
1 compromised version
- Jun 20, 2022
Malware in iv-build-utils
1 compromised version
- Jun 20, 2022
Malicious code in iv-uv-latency (npm)
- Jun 20, 2022
Malicious code in iv-batcher (npm)
- Jun 20, 2022
Malicious code in iv-api-call-tracker (npm)
- Jun 20, 2022
Malware in iv-batcher
1 compromised version
- Jun 20, 2022
Malware in iv-api-call-tracker
1 compromised version
- Jun 20, 2022
Malware in iv-uv-latency
1 compromised version
- Jun 20, 2022
Malicious code in plhqjs (npm)
- Jun 20, 2022
Malicious code in playhq_net_jwplayer (npm)
- Jun 20, 2022
Malicious code in iv-api-utils (npm)
- Jun 20, 2022
Malicious code in @bynder-private/persistgraphql-webpack-plugin (npm)
- Jun 20, 2022
Malicious code in @bynder-private/dragula (npm)
- Jun 20, 2022
Malware in plhqjs
1 compromised version
- Jun 20, 2022
Malware in @bynder-private/persistgraphql-webpack-plugin
1 compromised version
- Jun 20, 2022
Malware in @bynder-private/dragula
1 compromised version
- Jun 20, 2022
Malware in playhq_net_jwplayer
1 compromised version
- Jun 20, 2022
Malware in iv-api-utils
1 compromised version
- Jun 20, 2022
Malicious code in @elektra-web/client (npm)
- Jun 20, 2022
Malicious code in colors-design (npm)
- Jun 20, 2022
Malicious code in colors-art (npm)
- Jun 20, 2022
Malware in colors-art
1 compromised version
- Jun 20, 2022
Malware in @elektra-web/client
1 compromised version
- Jun 20, 2022
Malware in colors-design
1 compromised version
- Jun 20, 2022
Malicious code in plugin-transform-typeof-symbol (npm)
- Jun 20, 2022
Malicious code in plugin-transform-react-jsx (npm)
- Jun 20, 2022
Malicious code in azureazure (npm)
Page 7246 of 7,289