Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,428 total · sorted newest first- Jun 20, 2022
Malware in client-sdk-contract-tests
1 compromised version
- Jun 20, 2022
Malware in alpaca-oas
1 compromised version
- Jun 20, 2022
Malware in react-ldclient-default-values
1 compromised version
- Jun 20, 2022
Malware in theme-whale-light
1 compromised version
- Jun 20, 2022
Malware in helloreactnative
1 compromised version
- Jun 20, 2022
Malware in git-gatsby
1 compromised version
- Jun 20, 2022
Malware in assign-issue
1 compromised version
- Jun 20, 2022
Malware in web-scripts-monorepo
1 compromised version
- Jun 20, 2022
Malware in launchdarkly-cloudflare-worker-template
1 compromised version
- Jun 20, 2022
Malware in chain-desktop-wallet
1 compromised version
- Jun 20, 2022
Malware in th-simple-keyring
1 compromised version
- Jun 20, 2022
Malware in workers.cloudflare.com
1 compromised version
- Jun 20, 2022
Malware in workers-airtable-form
1 compromised version
- Jun 20, 2022
Malware in integration-framework
1 compromised version
- Jun 20, 2022
Malware in manualtestapp
1 compromised version
- Jun 20, 2022
Malware in toolbox-script
1 compromised version
- Jun 20, 2022
Malware in boilerplate-fig-autocomplete
1 compromised version
- Jun 20, 2022
Malware in blockchain-classic-wallet
1 compromised version
- Jun 20, 2022
Malware in cloudflare-docs-engine
1 compromised version
- Jun 20, 2022
Malware in miew-ap
1 compromised version
- Jun 20, 2022
Malware in angular-cloudinary-photo
1 compromised version
- Jun 20, 2022
Malware in share-service-client
1 compromised version
- Jun 20, 2022
Malware in dummy_app
1 compromised version
- Jun 20, 2022
Malware in timebase-web-admin
1 compromised version
- Jun 20, 2022
Malware in workerskv.gui
1 compromised version
- Jun 20, 2022
Malware in action-require-additional-reviewer
1 compromised version
- Jun 20, 2022
Malware in cloudinary-sample-angular
1 compromised version
- Jun 20, 2022
Malware in wwi-app
1 compromised version
- Jun 20, 2022
Malware in launchdarkly-api-typescript-sample
1 compromised version
- Jun 20, 2022
Malware in module-worker
1 compromised version
- Jun 20, 2022
Malware in atomic-next
1 compromised version
- Jun 20, 2022
Malware in blockchain-wallet-ios
1 compromised version
- Jun 20, 2022
Malware in atomic-angular
1 compromised version
- Jun 20, 2022
Malware in epam-assets
1 compromised version
- Jun 20, 2022
Malicious code in adelphi-api (npm)
- Jun 20, 2022
Malicious code in action-prebuildify (npm)
- Jun 20, 2022
Malicious code in zcli-monorepo (npm)
- Jun 20, 2022
Malicious code in vuestic-admin (npm)
- Jun 20, 2022
Malicious code in upload-dsyms-github-action (npm)
- Jun 20, 2022
Malicious code in stargate-docs (npm)
- Jun 20, 2022
Malicious code in sdk_repl_app (npm)
- Jun 20, 2022
Malicious code in pulsar-sink-docs (npm)
- Jun 20, 2022
Malicious code in procore-sample-ror (npm)
- Jun 20, 2022
Malicious code in pagespeed-server (npm)
- Jun 20, 2022
Malicious code in opensea-ships-log (npm)
- Jun 20, 2022
Malicious code in opensea-erc1155 (npm)
- Jun 20, 2022
Malicious code in opensea-creatures (npm)
- Jun 20, 2022
Malicious code in nodejs-driver (npm)
- Jun 20, 2022
Malicious code in nft-tutorial (npm)
- Jun 20, 2022
Malicious code in minicom-node (npm)
Page 7271 of 7,289