Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,425 total · sorted newest first- Jun 20, 2022
Malware in helix-slack-notification
1 compromised version
- Jun 20, 2022
Malware in megamanz07007
1 compromised version
- Jun 20, 2022
Malware in helix-contentsource-connector
1 compromised version
- Jun 20, 2022
Malicious code in action-publish-gh-pages (npm)
- Jun 20, 2022
Malicious code in action-create-release-pr (npm)
- Jun 20, 2022
Malicious code in webpack-vue-config (npm)
- Jun 20, 2022
Malicious code in ui-extensions-dev-console-app (npm)
- Jun 20, 2022
Malicious code in typescript-snap (npm)
- Jun 20, 2022
Malicious code in twofactor_totp (npm)
- Jun 20, 2022
Malicious code in template-snap-monorepo (npm)
- Jun 20, 2022
Malicious code in spaces-design (npm)
- Jun 20, 2022
Malicious code in snapcanvas-sdk (npm)
- Jun 20, 2022
Malicious code in slint-config-nodejs (npm)
- Jun 20, 2022
Malicious code in slack-notification (npm)
- Jun 20, 2022
Malicious code in shopify-marketplaces-buyer-app (npm)
- Jun 20, 2022
Malicious code in shopify-cli-extensions-test-utils (npm)
- Jun 20, 2022
Malicious code in sample-mini (npm)
- Jun 20, 2022
Malicious code in ruby-style-guide (npm)
- Jun 20, 2022
Malicious code in rnskia (npm)
- Jun 20, 2022
Malicious code in remote-ui (npm)
- Jun 20, 2022
Malicious code in react-native-performance-monorepo (npm)
- Jun 20, 2022
Malicious code in react-jesting-library (npm)
- Jun 20, 2022
Malicious code in polaris-for-vscode (npm)
- Jun 20, 2022
Malicious code in polaris-for-figma (npm)
- Jun 20, 2022
Malicious code in pcln-types (npm)
- Jun 20, 2022
Malicious code in nnabla-browser (npm)
- Jun 20, 2022
Malicious code in nft-tickets-workshop (npm)
- Jun 20, 2022
Malicious code in new-npm-packages (npm)
- Jun 20, 2022
Malicious code in minis-samples (npm)
- Jun 20, 2022
Malicious code in metamask-state-log-explorer (npm)
- Jun 20, 2022
Malicious code in metamask-docs (npm)
- Jun 20, 2022
Malicious code in metamask (npm)
- Jun 20, 2022
Malicious code in megaman-007mega (npm)
- Jun 20, 2022
Malicious code in mapray-js-monorepo (npm)
- Jun 20, 2022
Malicious code in iframe-execution-environment (npm)
- Jun 20, 2022
Malicious code in hydrogen-monorepo (npm)
- Jun 20, 2022
Malicious code in helix-rum-collector (npm)
- Jun 20, 2022
Malicious code in heft-component-rig (npm)
- Jun 20, 2022
Malicious code in generator-connection (npm)
- Jun 20, 2022
Malicious code in files_pdfviewer (npm)
- Jun 20, 2022
Malicious code in eyeglass-embroider-app (npm)
- Jun 20, 2022
Malicious code in example-typescript (npm)
- Jun 20, 2022
Malicious code in example-rust (npm)
- Jun 20, 2022
Malicious code in example-google-analytics (npm)
- Jun 20, 2022
Malicious code in example-api-routes (npm)
- Jun 20, 2022
Malicious code in ethers-js-snap (npm)
- Jun 20, 2022
Malicious code in eth-faucet (npm)
- Jun 20, 2022
Malicious code in discount-functions-sample-app (npm)
- Jun 20, 2022
Malicious code in contributor-site (npm)
- Jun 20, 2022
Malicious code in contract-metadata (npm)
Page 7267 of 7,289