Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,422 total in npm · sorted newest first- Nov 13, 2025
Malicious code in water-assert-file-data-emulate (npm)
- Nov 13, 2025
Malicious code in wasat-rimraf-csrf-halley (npm)
- Nov 13, 2025
Malicious code in wasat-pulsar-exobiology-link (npm)
- Nov 13, 2025
Malicious code in wasat-photon-await-mocha (npm)
- Nov 13, 2025
Malicious code in wasat-foundation-webdriverio-eslint (npm)
- Nov 13, 2025
Malicious code in wasat-dactyl-tailwindcss-dagda (npm)
- Nov 13, 2025
Malicious code in wasat-cosmochemistry-nucleosynthesis-nextjs (npm)
- Nov 13, 2025
Malicious code in wasat-carina-shelljs-sqlite (npm)
- Nov 13, 2025
Malicious code in wasat-bioinformatics-leda-bionics (npm)
- Nov 13, 2025
Malicious code in wasat-betelgeuse-mini-css-extract-plugin-cosmos (npm)
- Nov 13, 2025
Malicious code in warp-sails-selenology-gravity (npm)
- Nov 13, 2025
Malicious code in warp-ora-duplex-jekyll (npm)
- Nov 13, 2025
Malicious code in warp-mdx-hermes-europa (npm)
- Nov 13, 2025
Malicious code in warp-luminescence-ionosphere-baryon (npm)
- Nov 13, 2025
Malicious code in warp-jwt-mongoose-mira (npm)
- Nov 13, 2025
Malicious code in warp-hyperion-quasar-quark (npm)
- Nov 13, 2025
Malicious code in warp-elara-leda-bulma (npm)
- Nov 13, 2025
Malicious code in warp-dotenv-safe-andromeda-uglify-js (npm)
- Nov 13, 2025
Malicious code in warp-boson-callback-supercluster (npm)
- Nov 13, 2025
Malicious code in warp-asthenosphere-ganymede-publish (npm)
- Nov 13, 2025
Malicious code in warn-spy-grep-compress-load (npm)
- Nov 13, 2025
Malicious code in warn-sigma-cat-interpret-pipe (npm)
- Nov 13, 2025
Malicious code in warn-shell-async-virtualize-mu (npm)
- Nov 13, 2025
Malicious code in warn-pi-visualize-catch-slow (npm)
- Nov 13, 2025
Malicious code in warn-function-assert-report-thread (npm)
- Nov 13, 2025
Malicious code in warn-class-proxy-cron-earth (npm)
- Nov 13, 2025
Malicious code in warn-bash-grep-array-test (npm)
- Nov 13, 2025
Malicious code in warn-array-container-grid-stub (npm)
- Nov 13, 2025
Malicious code in vulcan-semantic-release-pino-adonis (npm)
- Nov 13, 2025
Malicious code in vulcan-rimraf-sirius-enceladus (npm)
- Nov 13, 2025
Malicious code in vulcan-quasar-prettier-europa (npm)
- Nov 13, 2025
Malicious code in vulcan-nestjs-pm2-biohacking (npm)
- Nov 13, 2025
Malicious code in vulcan-delphinus-protoplanetarydisk-gatsby (npm)
- Nov 13, 2025
Malicious code in vulcan-astrobiology-wavefunction-delphinus (npm)
- Nov 13, 2025
Malicious code in vulcan-asthenosphere-babel-exoplanet (npm)
- Nov 13, 2025
Malicious code in vuetify-xanadu-stratigraphy-sedimentology (npm)
- Nov 13, 2025
Malicious code in vuetify-thermochronology-csv-cryovolcano (npm)
- Nov 13, 2025
Malicious code in vuetify-solis-ariel-helios (npm)
- Nov 13, 2025
Malicious code in vuetify-ophiuchus-request-kaus (npm)
- Nov 13, 2025
Malicious code in vuetify-greatfilter-terser-dysonswarm (npm)
- Nov 13, 2025
Malicious code in vuetify-firebase-darkmatter-mineralogy (npm)
- Nov 13, 2025
Malicious code in vuepress-winston-deneb-vulcan (npm)
- Nov 13, 2025
Malicious code in vuepress-update-canopus-zooarchaeology (npm)
- Nov 13, 2025
Malicious code in vuepress-toml-magellan-rimraf (npm)
- Nov 13, 2025
Malicious code in vuepress-process-sagitta-postgres (npm)
- Nov 13, 2025
Malicious code in vuepress-parallax-socketio-juno (npm)
- Nov 13, 2025
Malicious code in vuepress-mineralogy-aldebaran-taphonomy (npm)
- Nov 13, 2025
Malicious code in vuepress-centauri-transhumanism-astrobiology (npm)
- Nov 13, 2025
Malicious code in vuepress-auth0-meteor-duplex (npm)
- Nov 13, 2025
Malicious code in vuepress-apollo-kuiperbelt-hercules (npm)
Page 274 of 4,809