Malicious JavaScript found in the wild. is a repository of malicious JavaScript that has been found in websites, extensions, npm packages, and anywhere else JavaScript lives.

You can help! Check out how to submit to learn how you can contribute.

WARNING: This JavaScript and any referenced URLs ARE KNOWN TO BE MALICIOUS. Use your head, don't run anything unless you know what you are doing.

Bad JavaScript Samples

  1. Smith & Wesson Skimmer

  2. purescript-installer

  3. electron-native-notify

  4. Forbes magecart skimmer

  5. event-stream

  6. NewEgg magecart skimmer

  7. British Airways magecart skimmer

  8. Ticketmaster magecart skimmer

  9. KopiLuwak

  10. RAA Ransomware