Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,428 total · sorted newest first- Jun 20, 2022
Malicious code in serotonine320 (npm)
- Jun 20, 2022
Malicious code in @rnps-ppr/ppr-gensenjs (npm)
- Jun 20, 2022
Malicious code in @rnps-ppr/gensen-gotham (npm)
- Jun 20, 2022
Malicious code in perulema (npm)
- Jun 20, 2022
Malware in serotonine320
1 compromised version
- Jun 20, 2022
Malware in @rnps-ppr/ppr-gensenjs
1 compromised version
- Jun 20, 2022
Malware in @rnps-ppr/gensen-gotham
1 compromised version
- Jun 20, 2022
Malware in perulema
1 compromised version
- Jun 20, 2022
Malicious code in @jumpstart-ui/utils (npm)
- Jun 20, 2022
Malicious code in color2.0.0 (npm)
- Jun 20, 2022
Malicious code in @contrast-security-inc/design-system-foundations (npm)
- Jun 20, 2022
Malicious code in angieslist-styles (npm)
- Jun 20, 2022
Malware in @jumpstart-ui/utils
1 compromised version
- Jun 20, 2022
Malware in color2.0.0
1 compromised version
- Jun 20, 2022
Malware in angieslist-styles
1 compromised version
- Jun 20, 2022
Malware in @contrast-security-inc/design-system-foundations
1 compromised version
- Jun 20, 2022
Malicious code in adiostcheusia (npm)
- Jun 20, 2022
Malicious code in ctct-helpers (npm)
- Jun 20, 2022
Malicious code in colors-2.0.0 (npm)
- Jun 20, 2022
Malicious code in bender-event-definition-loader (npm)
- Jun 20, 2022
Malicious code in apinitro (npm)
- Jun 20, 2022
Malware in ctct-helpers
1 compromised version
- Jun 20, 2022
Malware in bender-event-definition-loader
1 compromised version
- Jun 20, 2022
Malware in apinitro
1 compromised version
- Jun 20, 2022
Malware in adiostcheusia
1 compromised version
- Jun 20, 2022
Malware in colors-2.0.0
1 compromised version
- Jun 20, 2022
Malicious code in mailduli (npm)
- Jun 20, 2022
Malicious code in gd-ldc (npm)
- Jun 20, 2022
Malicious code in fe-fabric-react (npm)
- Jun 20, 2022
Malicious code in dropins-components (npm)
- Jun 20, 2022
Malware in gd-ldc
1 compromised version
- Jun 20, 2022
Malware in mailduli
1 compromised version
- Jun 20, 2022
Malware in fe-fabric-react
1 compromised version
- Jun 20, 2022
Malware in dropins-components
1 compromised version
- Jun 20, 2022
Malicious code in roblox-es6-migration-helper (npm)
- Jun 20, 2022
Malicious code in ot-react-jed (npm)
- Jun 20, 2022
Malicious code in odesk.bpa-tsf-calc-bundle (npm)
- Jun 20, 2022
Malicious code in monday-ui-react-core-vibe (npm)
- Jun 20, 2022
Malware in monday-ui-react-core-vibe
1 compromised version
- Jun 20, 2022
Malware in odesk.bpa-tsf-calc-bundle
1 compromised version
- Jun 20, 2022
Malware in ot-react-jed
1 compromised version
- Jun 20, 2022
Malware in roblox-es6-migration-helper
1 compromised version
- Jun 20, 2022
Malicious code in xenolith (npm)
- Jun 20, 2022
Malicious code in redocoem-bamm (npm)
- Jun 20, 2022
Malicious code in meoconlonton-vhx-fresh (npm)
- Jun 20, 2022
Malicious code in meoconlonton-vhx (npm)
- Jun 20, 2022
Malware in meoconlonton-vhx-fresh
1 compromised version
- Jun 20, 2022
Malware in meoconlonton-vhx
1 compromised version
- Jun 20, 2022
Malware in redocoem-bamm
1 compromised version
- Jun 20, 2022
Malware in xenolith
1 compromised version
Page 7249 of 7,289