Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,429 total · sorted newest first- Jun 20, 2022
Malicious code in gd-display-ads (npm)
- Jun 20, 2022
Malware in gd-display-ads
1 compromised version
- Jun 20, 2022
Malware in gd-sass
1 compromised version
- Jun 20, 2022
Malware in gd-lazyload
1 compromised version
- Jun 20, 2022
Malware in gd-ui-kit
1 compromised version
- Jun 20, 2022
Malicious code in www.podium.com (npm)
- Jun 20, 2022
Malicious code in raygun.status (npm)
- Jun 20, 2022
Malicious code in gd-header (npm)
- Jun 20, 2022
Malicious code in gd-analytics (npm)
- Jun 20, 2022
Malware in gd-analytics
1 compromised version
- Jun 20, 2022
Malware in www.podium.com
1 compromised version
- Jun 20, 2022
Malware in raygun.status
1 compromised version
- Jun 20, 2022
Malware in gd-header
1 compromised version
- Jun 20, 2022
Malicious code in sa-383-bulk-creative-update (npm)
- Jun 20, 2022
Malicious code in @bijie/react-bnb (npm)
- Jun 20, 2022
Malware in sa-383-bulk-creative-update
1 compromised version
- Jun 20, 2022
Malware in @bijie/react-bnb
1 compromised version
- Jun 20, 2022
Malicious code in @bijie/react-bnb-biz (npm)
- Jun 20, 2022
Malware in @bijie/react-bnb-biz
1 compromised version
- Jun 20, 2022
Malicious code in test-marek-common (npm)
- Jun 20, 2022
Malicious code in test-custom-repo (npm)
- Jun 20, 2022
Malicious code in @hex-/xd (npm)
- Jun 20, 2022
Malicious code in bsd-global-nav-design-ui (npm)
- Jun 20, 2022
Malware in test-marek-common
1 compromised version
- Jun 20, 2022
Malware in test-custom-repo
1 compromised version
- Jun 20, 2022
Malware in @hex-/xd
1 compromised version
- Jun 20, 2022
Malware in bsd-global-nav-design-ui
1 compromised version
- Jun 20, 2022
Malicious code in ringcentral-common-redirect (npm)
- Jun 20, 2022
Malicious code in plugin-bugfix-v8-spread-parameters-in-optional-chaining (npm)
- Jun 20, 2022
Malicious code in client-recommendation (npm)
- Jun 20, 2022
Malicious code in azure-app-configuration-samples-ts (npm)
- Jun 20, 2022
Malware in client-recommendation
1 compromised version
- Jun 20, 2022
Malware in plugin-bugfix-v8-spread-parameters-in-optional-chaining
1 compromised version
- Jun 20, 2022
Malware in ringcentral-common-redirect
1 compromised version
- Jun 20, 2022
Malware in azure-app-configuration-samples-ts
1 compromised version
- Jun 20, 2022
Malicious code in zmarta-calculator (npm)
- Jun 20, 2022
Malicious code in language-service (npm)
- Jun 20, 2022
Malicious code in helper-module-context (npm)
- Jun 20, 2022
Malicious code in assessment-zmarta (npm)
- Jun 20, 2022
Malware in language-service
1 compromised version
- Jun 20, 2022
Malware in helper-module-context
1 compromised version
- Jun 20, 2022
Malware in assessment-zmarta
1 compromised version
- Jun 20, 2022
Malware in zmarta-calculator
1 compromised version
- Jun 20, 2022
Malicious code in production-x-company-internal1 (npm)
- Jun 20, 2022
Malicious code in plugin-svgo (npm)
- Jun 20, 2022
Malicious code in oci-console-navigation-registry (npm)
- Jun 20, 2022
Malicious code in kerocinefuel (npm)
- Jun 20, 2022
Malware in plugin-svgo
1 compromised version
- Jun 20, 2022
Malware in kerocinefuel
1 compromised version
- Jun 20, 2022
Malware in production-x-company-internal1
1 compromised version
Page 7248 of 7,289