Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,428 total · sorted newest first- Jun 20, 2022
Malware in tiktok_embed
1 compromised version
- Jun 20, 2022
Malware in simplemde-angular
1 compromised version
- Jun 20, 2022
Malicious code in af-test (npm)
- Jun 20, 2022
Malicious code in af-mason (npm)
- Jun 20, 2022
Malicious code in clientlib-manifests (npm)
- Jun 20, 2022
Malware in af-test
1 compromised version
- Jun 20, 2022
Malware in af-mason
1 compromised version
- Jun 20, 2022
Malware in clientlib-manifests
1 compromised version
- Jun 20, 2022
Malicious code in ui-extensions-server-kit (npm)
- Jun 20, 2022
Malicious code in realtime-react (npm)
- Jun 20, 2022
Malicious code in react-monorail-next (npm)
- Jun 20, 2022
Malicious code in onboarding-setup-guide (npm)
- Jun 20, 2022
Malware in onboarding-setup-guide
1 compromised version
- Jun 20, 2022
Malware in realtime-react
1 compromised version
- Jun 20, 2022
Malware in react-monorail-next
1 compromised version
- Jun 20, 2022
Malware in ui-extensions-server-kit
1 compromised version
- Jun 20, 2022
Malicious code in spiferack (npm)
- Jun 20, 2022
Malicious code in realtime-react-ui (npm)
- Jun 20, 2022
Malicious code in polaris-next (npm)
- Jun 20, 2022
Malicious code in apollo-workarounds (npm)
- Jun 20, 2022
Malware in polaris-next
1 compromised version
- Jun 20, 2022
Malware in realtime-react-ui
1 compromised version
- Jun 20, 2022
Malware in apollo-workarounds
1 compromised version
- Jun 20, 2022
Malware in spiferack
1 compromised version
- Jun 20, 2022
Malicious code in supplysec-alert (npm)
- Jun 20, 2022
Malicious code in piwik-pro-angular-tracking (npm)
- Jun 20, 2022
Malicious code in data-api.js-core (npm)
- Jun 20, 2022
Malicious code in colors-1.0 (npm)
- Jun 20, 2022
Malware in supplysec-alert
1 compromised version
- Jun 20, 2022
Malware in colors-1.0
1 compromised version
- Jun 20, 2022
Malware in piwik-pro-angular-tracking
1 compromised version
- Jun 20, 2022
Malware in data-api.js-core
1 compromised version
- Jun 20, 2022
Malicious code in snyk-resolve-dep (npm)
- Jun 20, 2022
Malicious code in snyk-azure-pipelines-task (npm)
- Jun 20, 2022
Malicious code in ffwebsite (npm)
- Jun 20, 2022
Malicious code in aoxqgmortgkgldq (npm)
- Jun 20, 2022
Malware in snyk-resolve-dep
1 compromised version
- Jun 20, 2022
Malware in snyk-azure-pipelines-task
1 compromised version
- Jun 20, 2022
Malware in aoxqgmortgkgldq
1 compromised version
- Jun 20, 2022
Malware in ffwebsite
1 compromised version
- Jun 20, 2022
Malicious code in touchright (npm)
- Jun 20, 2022
Malicious code in intentionally-malicious1 (npm)
- Jun 20, 2022
Malicious code in intentionally-malicious (npm)
- Jun 20, 2022
Malicious code in drwffjbwkwxsvyo (npm)
- Jun 20, 2022
Malware in intentionally-malicious1
1 compromised version
- Jun 20, 2022
Malware in touchright
1 compromised version
- Jun 20, 2022
Malware in drwffjbwkwxsvyo
1 compromised version
- Jun 20, 2022
Malware in intentionally-malicious
1 compromised version
- Jun 20, 2022
Malicious code in @w3-commons/js-build-resources (npm)
- Jun 20, 2022
Malicious code in @ibm-pipeline/logging (npm)
Page 7255 of 7,289