Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,421 total · sorted newest first- Jun 20, 2022
Malicious code in attention-editor (npm)
- Jun 20, 2022
Malware in remote-ui
1 compromised version
- Jun 20, 2022
Malware in twofactor_totp
1 compromised version
- Jun 20, 2022
Malware in nft-tickets-workshop
1 compromised version
- Jun 20, 2022
Malware in helix-rum-collector
1 compromised version
- Jun 20, 2022
Malware in react-native-performance-monorepo
1 compromised version
- Jun 20, 2022
Malware in generator-connection
1 compromised version
- Jun 20, 2022
Malware in babel-preset-es201
1 compromised version
- Jun 20, 2022
Malware in action-publish-gh-pages
1 compromised version
- Jun 20, 2022
Malware in attention-editor
1 compromised version
- Jun 20, 2022
Malware in discount-functions-sample-app
1 compromised version
- Jun 20, 2022
Malware in sample-mini
1 compromised version
- Jun 20, 2022
Malware in example-google-analytics
1 compromised version
- Jun 20, 2022
Malware in slint-config-nodejs
1 compromised version
- Jun 20, 2022
Malware in shopify-cli-extensions-test-utils
1 compromised version
- Jun 20, 2022
Malware in metamask-docs
1 compromised version
- Jun 20, 2022
Malware in metamask
1 compromised version
- Jun 20, 2022
Malware in ui-extensions-dev-console-app
1 compromised version
- Jun 20, 2022
Malware in shopify-marketplaces-buyer-app
1 compromised version
- Jun 20, 2022
Malware in eyeglass-embroider-app
1 compromised version
- Jun 20, 2022
Malware in ruby-style-guide
1 compromised version
- Jun 20, 2022
Malware in com.natw.secret_store_example
1 compromised version
- Jun 20, 2022
Malware in example-typescript
1 compromised version
- Jun 20, 2022
Malware in spaces-design
1 compromised version
- Jun 20, 2022
Malware in contributor-site
1 compromised version
- Jun 20, 2022
Malware in contentsource-connector
1 compromised version
- Jun 20, 2022
Malware in mapray-js-monorepo
1 compromised version
- Jun 20, 2022
Malware in ethers-js-snap
1 compromised version
- Jun 20, 2022
Malware in iframe-execution-environment
1 compromised version
- Jun 20, 2022
Malware in metamask-state-log-explorer
1 compromised version
- Jun 20, 2022
Malware in hydrogen-monorepo
1 compromised version
- Jun 20, 2022
Malware in rnskia
1 compromised version
- Jun 20, 2022
Malware in megaman-007mega
1 compromised version
- Jun 20, 2022
Malware in minis-samples
1 compromised version
- Jun 20, 2022
Malware in snapcanvas-sdk
1 compromised version
- Jun 20, 2022
Malware in slack-notification
1 compromised version
- Jun 20, 2022
Malware in eth-faucet
1 compromised version
- Jun 20, 2022
Malware in pcln-types
1 compromised version
- Jun 20, 2022
Malware in contract-metadata
1 compromised version
- Jun 20, 2022
Malware in heft-component-rig
1 compromised version
- Jun 20, 2022
Malware in template-snap-monorepo
1 compromised version
- Jun 20, 2022
Malware in typescript-snap
1 compromised version
- Jun 20, 2022
Malware in example-api-routes
1 compromised version
- Jun 20, 2022
Malware in nnabla-browser
1 compromised version
- Jun 20, 2022
Malware in polaris-for-figma
1 compromised version
- Jun 20, 2022
Malware in example-rust
1 compromised version
- Jun 20, 2022
Malware in action-create-release-pr
1 compromised version
- Jun 20, 2022
Malware in files_pdfviewer
1 compromised version
- Jun 20, 2022
Malware in webpack-vue-config
1 compromised version
- Jun 20, 2022
Malware in polaris-for-vscode
1 compromised version
Page 7268 of 7,289