Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,422 total in npm · sorted newest first- Nov 13, 2025
Malicious code in zooarchaeology-install-aether-extremophile (npm)
- Nov 13, 2025
Malicious code in zooarchaeology-gammarayburst-blueshift-vuepress (npm)
- Nov 13, 2025
Malicious code in zooarchaeology-darkmatter-higgs-algol (npm)
- Nov 13, 2025
Malicious code in zooarchaeology-configstore-google-darkenergy (npm)
- Nov 13, 2025
Malicious code in zeta-try-stack-alert-cache (npm)
- Nov 13, 2025
Malicious code in zeta-transpile-encode-pi-table (npm)
- Nov 13, 2025
Malicious code in zeta-permission-beta-short-async (npm)
- Nov 13, 2025
Malicious code in zeta-lambda-info-view-star (npm)
- Nov 13, 2025
Malicious code in zeta-lambda-abstract-eta-secure (npm)
- Nov 13, 2025
Malicious code in zeta-cold-notify-fire-easy (npm)
- Nov 13, 2025
Malicious code in zeta-beta-secure-secure-load (npm)
- Nov 13, 2025
Malicious code in zero-warn-char-class-visualize (npm)
- Nov 13, 2025
Malicious code in zero-finally-new-easy-phi (npm)
- Nov 13, 2025
Malicious code in zero-epsilon-bash-cache-query (npm)
- Nov 13, 2025
Malicious code in zero-daemon-small-fire-pi (npm)
- Nov 13, 2025
Malicious code in zephyr-yakutsk-update-fornax (npm)
- Nov 13, 2025
Malicious code in zephyr-sadr-child-process-bootes (npm)
- Nov 13, 2025
Malicious code in zephyr-promise-morgan-indus (npm)
- Nov 13, 2025
Malicious code in zephyr-prettier-sequelize-callisto (npm)
- Nov 13, 2025
Malicious code in zephyr-neptune-dactyl-aurora (npm)
- Nov 13, 2025
Malicious code in zephyr-mongodb-wavefunction-pm2 (npm)
- Nov 13, 2025
Malicious code in zephyr-local-hexo-meteor (npm)
- Nov 13, 2025
Malicious code in zephyr-leda-procyon-pegasus (npm)
- Nov 13, 2025
Malicious code in zephyr-hyperion-cypress-pulsar (npm)
- Nov 13, 2025
Malicious code in zephyr-ganymede-fomalhaut-hercules (npm)
- Nov 13, 2025
Malicious code in zephyr-eris-spinner-quasar (npm)
- Nov 13, 2025
Malicious code in zephyr-dotenv-technosignature-uranology (npm)
- Nov 13, 2025
Malicious code in zephyr-barnard-troposphere-nucleosynthesis (npm)
- Nov 13, 2025
Malicious code in zephyr-auriga-node-config-wolf (npm)
- Nov 13, 2025
Malicious code in zenobia-zephyr-dactyl-planetology (npm)
- Nov 13, 2025
Malicious code in zenobia-terser-chromedriver-paleoclimatology (npm)
- Nov 13, 2025
Malicious code in zenobia-sirius-paleoclimatology-enceladus (npm)
- Nov 13, 2025
Malicious code in zenobia-rate-limiter-cosmos-csrf (npm)
- Nov 13, 2025
Malicious code in zenobia-quantum-yakutsk-superflare (npm)
- Nov 13, 2025
Malicious code in zenobia-nightwatch-rigel-javascript (npm)
- Nov 13, 2025
Malicious code in zenobia-mdx-phoenix-kronos (npm)
- Nov 13, 2025
Malicious code in zenobia-grus-readable-semantic-ui (npm)
- Nov 13, 2025
Malicious code in zenobia-google-readable-paleobotany (npm)
- Nov 13, 2025
Malicious code in zenobia-colors-neptunology-darkmatter (npm)
- Nov 13, 2025
Malicious code in zenith-registry-materialize-quasar (npm)
- Nov 13, 2025
Malicious code in zenith-geckodriver-rimraf-non-blocking (npm)
- Nov 13, 2025
Malicious code in zenith-cosmiconfig-miranda-standard (npm)
- Nov 13, 2025
Malicious code in zenith-cladistics-plutology-luna (npm)
- Nov 13, 2025
Malicious code in zenith-algol-nodejs-pegasus (npm)
- Nov 13, 2025
Malicious code in yonder-xerxes-xanthus-halley (npm)
- Nov 13, 2025
Malicious code in yonder-webdriverio-lynx-blackhole (npm)
- Nov 13, 2025
Malicious code in yonder-sedna-innercore-slidev (npm)
- Nov 13, 2025
Malicious code in yonder-sass-loader-firebase-cosmicsilence (npm)
- Nov 13, 2025
Malicious code in yonder-rollup-dynamo-build (npm)
- Nov 13, 2025
Malicious code in yonder-mineralogy-ablation-achernar (npm)
Page 269 of 4,809