Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,422 total in npm · sorted newest first- Nov 13, 2025
Malicious code in upgrade-mysql-biomimicry-async (npm)
- Nov 13, 2025
Malicious code in upgrade-mesosphere-slides-sirius (npm)
- Nov 13, 2025
Malicious code in upgrade-hexo-gulp-cosmogenic (npm)
- Nov 13, 2025
Malicious code in upgrade-dysonswarm-node-config-got (npm)
- Nov 13, 2025
Malicious code in upgrade-async-forever-nextjs (npm)
- Nov 13, 2025
Malicious code in update-tethys-query-mensa (npm)
- Nov 13, 2025
Malicious code in update-proxima-xenobiology-sqlite (npm)
- Nov 13, 2025
Malicious code in update-proxima-isostasy-archaeometry (npm)
- Nov 13, 2025
Malicious code in update-meteor-jupiter-kaus (npm)
- Nov 13, 2025
Malicious code in update-leda-ora-bootes (npm)
- Nov 13, 2025
Malicious code in update-hadron-rehype-phoenix (npm)
- Nov 13, 2025
Malicious code in update-dorado-farout-draco (npm)
- Nov 13, 2025
Malicious code in update-barnard-rigel-readable (npm)
- Nov 13, 2025
Malicious code in update-astroinformatics-technosignature-bellatrix (npm)
- Nov 13, 2025
Malicious code in unuk-uglify-js-astrochemistry-comet (npm)
- Nov 13, 2025
Malicious code in unuk-tethys-blueshift-cosmicsilence (npm)
- Nov 13, 2025
Malicious code in unuk-nightmare-antares-galaxy (npm)
- Nov 13, 2025
Malicious code in unuk-mui-antares-neuromorphic (npm)
- Nov 13, 2025
Malicious code in unuk-loop-mdx-mysql (npm)
- Nov 13, 2025
Malicious code in unuk-hapi-cross-env-nashira (npm)
- Nov 13, 2025
Malicious code in unuk-gatsby-dysonswarm-izar (npm)
- Nov 13, 2025
Malicious code in unuk-eris-paleontology-spectron (npm)
- Nov 13, 2025
Malicious code in unuk-deneb-pegasus-primatology (npm)
- Nov 13, 2025
Malicious code in unuk-cygnus-lyra-buffer (npm)
- Nov 13, 2025
Malicious code in unuk-cryonics-gravitationalwave-meteor (npm)
- Nov 13, 2025
Malicious code in unuk-chalk-proxima-test (npm)
- Nov 13, 2025
Malicious code in unix-zeta-star-execute-uglify (npm)
- Nov 13, 2025
Malicious code in unix-web-export-key-data (npm)
- Nov 13, 2025
Malicious code in unix-scale-protected-test-fire (npm)
- Nov 13, 2025
Malicious code in unix-execute-file-route-reject (npm)
- Nov 13, 2025
Malicious code in unix-earth-zero-decrypt-log (npm)
- Nov 13, 2025
Malicious code in uninstall-semantic-ui-await-postcss (npm)
- Nov 13, 2025
Malicious code in uninstall-sails-development-dynamo (npm)
- Nov 13, 2025
Malicious code in uninstall-higgs-aether-enceladus (npm)
- Nov 13, 2025
Malicious code in umbriel-zenobia-sedna-odin (npm)
- Nov 13, 2025
Malicious code in umbriel-transform-corvus-request (npm)
- Nov 13, 2025
Malicious code in umbriel-spica-rate-limiter-auriga (npm)
- Nov 13, 2025
Malicious code in umbriel-singularity-auth0-polaris (npm)
- Nov 13, 2025
Malicious code in umbriel-paleoanthropology-aldebaran-areology (npm)
- Nov 13, 2025
Malicious code in umbriel-leda-pipe-process (npm)
- Nov 13, 2025
Malicious code in umbriel-kastra-gacrux-google (npm)
- Nov 13, 2025
Malicious code in umbriel-gulp-sqlite-shelljs (npm)
- Nov 13, 2025
Malicious code in umbriel-eslint-config-kardashevscale-jwt (npm)
- Nov 13, 2025
Malicious code in umbriel-bootstrap-polaris-comet (npm)
- Nov 13, 2025
Malicious code in umbriel-ariel-rigel-metalsmith (npm)
- Nov 13, 2025
Malicious code in umbra-octans-ablation-deneb (npm)
- Nov 13, 2025
Malicious code in umbra-mensa-bunyan-non-blocking (npm)
- Nov 13, 2025
Malicious code in umbra-jekyll-foundation-graphql (npm)
- Nov 13, 2025
Malicious code in umbra-iota-graphql-callback (npm)
- Nov 13, 2025
Malicious code in umbra-farout-barnard-redshift (npm)
Page 277 of 4,809