Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,422 total in npm · sorted newest first- Nov 13, 2025
Malicious code in titan-despina-zenobia-antares (npm)
- Nov 13, 2025
Malicious code in titan-bootstrap-lynx-comet (npm)
- Nov 13, 2025
Malicious code in thuban-zooarchaeology-norma-palynology (npm)
- Nov 13, 2025
Malicious code in thuban-run-script-octans-eslint (npm)
- Nov 13, 2025
Malicious code in thuban-charon-uninstall-nextjs (npm)
- Nov 13, 2025
Malicious code in thuban-areology-event-quasar (npm)
- Nov 13, 2025
Malicious code in throw-uglify-old-spy-water (npm)
- Nov 13, 2025
Malicious code in throw-simple-old-export-info (npm)
- Nov 13, 2025
Malicious code in throw-omega-catch-hot-sanitize (npm)
- Nov 13, 2025
Malicious code in throw-long-stub-thread-small (npm)
- Nov 13, 2025
Malicious code in throw-deploy-throw-error-iota (npm)
- Nov 13, 2025
Malicious code in throw-bad-orchestrate-analyze-cat (npm)
- Nov 13, 2025
Malicious code in throw-async-object-public-integer (npm)
- Nov 13, 2025
Malicious code in throw-analyze-cat-finally-assert (npm)
- Nov 13, 2025
Malicious code in thread-simulate-meta-small-cat (npm)
- Nov 13, 2025
Malicious code in thread-monitor-async-omicron-optimize (npm)
- Nov 13, 2025
Malicious code in thread-link-code-stack-old (npm)
- Nov 13, 2025
Malicious code in thread-daemon-try-omega-mock (npm)
- Nov 13, 2025
Malicious code in thread-compile-parse-decrypt-air (npm)
- Nov 13, 2025
Malicious code in theta-yaml-compress-rain-star (npm)
- Nov 13, 2025
Malicious code in theta-validate-meta-air-cat (npm)
- Nov 13, 2025
Malicious code in theta-daemon-moon-char-info (npm)
- Nov 13, 2025
Malicious code in theta-air-char-import-phi (npm)
- Nov 13, 2025
Malicious code in thermosphere-node-sass-farout-seismology (npm)
- Nov 13, 2025
Malicious code in thermochronology-plutology-magnetar-nightwatch (npm)
- Nov 13, 2025
Malicious code in thermochronology-paleoclimatology-redgiant-celeste (npm)
- Nov 13, 2025
Malicious code in thermochronology-metabolomics-semantic-ui-aquarius (npm)
- Nov 13, 2025
Malicious code in thermochronology-gravity-commitlint-element-ui (npm)
- Nov 13, 2025
Malicious code in thermochronology-dorado-epigenetics-regulus (npm)
- Nov 13, 2025
Malicious code in tethys-schema-proteomics-nuxtjs (npm)
- Nov 13, 2025
Malicious code in tethys-primatology-selenium-yonder (npm)
- Nov 13, 2025
Malicious code in tethys-geodynamo-mongoose-venus (npm)
- Nov 13, 2025
Malicious code in tethys-deimos-spinner-eslint-config (npm)
- Nov 13, 2025
Malicious code in tethys-acamar-protractor-html-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in testcafe-titan-fornax-astro (npm)
- Nov 13, 2025
Malicious code in testcafe-scripts-phoebe-nconf (npm)
- Nov 13, 2025
Malicious code in testcafe-postcss-europa-atlas (npm)
- Nov 13, 2025
Malicious code in testcafe-pegasus-neptune-remark (npm)
- Nov 13, 2025
Malicious code in testcafe-miranda-electron-umbriel (npm)
- Nov 13, 2025
Malicious code in testcafe-markdownlint-antares-jsonp (npm)
- Nov 13, 2025
Malicious code in testcafe-jsonp-lyra-antd (npm)
- Nov 13, 2025
Malicious code in testcafe-janus-sqlite-bulma (npm)
- Nov 13, 2025
Malicious code in testcafe-chalk-magellan-figures (npm)
- Nov 13, 2025
Malicious code in testcafe-canopus-graphql-markdownlint (npm)
- Nov 13, 2025
Malicious code in test-umbra-elektra-update (npm)
- Nov 13, 2025
Malicious code in test-theta-old-yaml-eta (npm)
- Nov 13, 2025
Malicious code in test-sudo-notify-meta-orchestrate (npm)
- Nov 13, 2025
Malicious code in test-star-web-zeta-minify (npm)
- Nov 13, 2025
Malicious code in test-slides-bellatrix-io (npm)
- Nov 13, 2025
Malicious code in test-sigma-reject-daemon-cold (npm)
Page 280 of 4,809