Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,422 total in npm · sorted newest first- Nov 13, 2025
Malicious code in winston-neutrino-commitlint-tachyon (npm)
- Nov 13, 2025
Malicious code in winston-lint-staged-ganymede-parcel (npm)
- Nov 13, 2025
Malicious code in winston-leda-mesosphere-umbra (npm)
- Nov 13, 2025
Malicious code in winston-kinetic-zenith-corvus (npm)
- Nov 13, 2025
Malicious code in winston-jwt-vuepress-prettier (npm)
- Nov 13, 2025
Malicious code in winston-html-webpack-plugin-hologram-meteor (npm)
- Nov 13, 2025
Malicious code in winston-hadron-neptune-biomimicry (npm)
- Nov 13, 2025
Malicious code in winston-gridsome-oortcloud-pegasus (npm)
- Nov 13, 2025
Malicious code in winston-boson-publish-cluster (npm)
- Nov 13, 2025
Malicious code in winston-adonis-dotenv-parse-variables-dagda (npm)
- Nov 13, 2025
Malicious code in wind-sun-stub-function-import (npm)
- Nov 13, 2025
Malicious code in wind-quick-char-yaml-thread (npm)
- Nov 13, 2025
Malicious code in wind-psi-zeta-debug-zeta (npm)
- Nov 13, 2025
Malicious code in wind-phi-pi-zeta-virtualize (npm)
- Nov 13, 2025
Malicious code in wind-execute-authorize-mu-byte (npm)
- Nov 13, 2025
Malicious code in wind-char-function-resolve-enum (npm)
- Nov 13, 2025
Malicious code in whitedwarf-tectonic-izar-hermes (npm)
- Nov 13, 2025
Malicious code in whitedwarf-selenology-jsonp-version (npm)
- Nov 13, 2025
Malicious code in whitedwarf-meissa-standard-mira (npm)
- Nov 13, 2025
Malicious code in whitedwarf-inquirer-csv-blitz (npm)
- Nov 13, 2025
Malicious code in whitedwarf-fomalhaut-nodemon-pipe (npm)
- Nov 13, 2025
Malicious code in wezen-xerxes-vortex-adonis (npm)
- Nov 13, 2025
Malicious code in wezen-paleoanthropology-betelgeuse-asthenosphere (npm)
- Nov 13, 2025
Malicious code in wezen-mutation-ora-grunt (npm)
- Nov 13, 2025
Malicious code in wezen-lepton-bootes-ultra (npm)
- Nov 13, 2025
Malicious code in wezen-hexo-update-lithosphere (npm)
- Nov 13, 2025
Malicious code in wezen-halley-less-io (npm)
- Nov 13, 2025
Malicious code in wezen-centauri-mutation-link (npm)
- Nov 13, 2025
Malicious code in weywot-wezen-cryovolcano-auriga (npm)
- Nov 13, 2025
Malicious code in weywot-wezen-bootes-nodemon (npm)
- Nov 13, 2025
Malicious code in weywot-webdriver-mocha-loglevel-fornax (npm)
- Nov 13, 2025
Malicious code in weywot-wasat-galaxy-miranda (npm)
- Nov 13, 2025
Malicious code in weywot-tool-eslint-config-dotenv (npm)
- Nov 13, 2025
Malicious code in weywot-resolvers-vuepress-rollup (npm)
- Nov 13, 2025
Malicious code in weywot-prompts-nestjs-nuxtjs (npm)
- Nov 13, 2025
Malicious code in weywot-phoenix-betelgeuse-janus (npm)
- Nov 13, 2025
Malicious code in weywot-perseus-parallax-meteor (npm)
- Nov 13, 2025
Malicious code in weywot-less-meteor-jupiter (npm)
- Nov 13, 2025
Malicious code in weywot-astrobiology-biomimicry-postcss (npm)
- Nov 13, 2025
Malicious code in websockets-winston-neptune-ablation (npm)
- Nov 13, 2025
Malicious code in websockets-thuban-antares-yakutsk (npm)
- Nov 13, 2025
Malicious code in websockets-kinetic-janus-sedna (npm)
- Nov 13, 2025
Malicious code in websockets-hawkingradiation-redis-barnard (npm)
- Nov 13, 2025
Malicious code in websockets-areology-perseus-redgiant (npm)
- Nov 13, 2025
Malicious code in webpack-xenon-relay-carpo (npm)
- Nov 13, 2025
Malicious code in webpack-query-thermochronology-antimatter (npm)
- Nov 13, 2025
Malicious code in webpack-quantum-babel-dione (npm)
- Nov 13, 2025
Malicious code in webpack-less-heliophysics-wavefunction (npm)
- Nov 13, 2025
Malicious code in webpack-exec-adonis-terser-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in webpack-dotenv-safe-avior-nodejs (npm)
Page 272 of 4,809