Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,422 total in npm · sorted newest first- Nov 13, 2025
Malicious code in test-playwright-primatology-asteroid (npm)
- Nov 13, 2025
Malicious code in test-on-spinner-docusaurus (npm)
- Nov 13, 2025
Malicious code in test-meissa-stream-leda (npm)
- Nov 13, 2025
Malicious code in test-janus-eslint-config-materialize (npm)
- Nov 13, 2025
Malicious code in test-fork-gravity-puppeteer (npm)
- Nov 13, 2025
Malicious code in test-cache-rehype-backend (npm)
- Nov 13, 2025
Malicious code in test-book-final-epsilon-char (npm)
- Nov 13, 2025
Malicious code in terser-weywot-typeorm-regulus (npm)
- Nov 13, 2025
Malicious code in terser-webpack-plugin-spectron-webdriver-sirius-enceladus (npm)
- Nov 13, 2025
Malicious code in terser-webpack-plugin-rollup-plugin-cybernetics-lacerta (npm)
- Nov 13, 2025
Malicious code in terser-webpack-plugin-nucleosynthesis-hadron-taurus (npm)
- Nov 13, 2025
Malicious code in terser-webpack-plugin-nestjs-umbriel-cluster (npm)
- Nov 13, 2025
Malicious code in terser-webpack-plugin-mechatronics-rest-neptunology (npm)
- Nov 13, 2025
Malicious code in terser-webpack-plugin-delphinus-membrane-cryovolcano (npm)
- Nov 13, 2025
Malicious code in terser-webpack-plugin-centaurus-version-duplex (npm)
- Nov 13, 2025
Malicious code in terser-webpack-plugin-canopus-troposphere-ichnology (npm)
- Nov 13, 2025
Malicious code in terser-webpack-plugin-andromeda-zenobia-pavo (npm)
- Nov 13, 2025
Malicious code in terser-subscription-kuiperbelt-cryptography (npm)
- Nov 13, 2025
Malicious code in terser-sequelize-oberon-config (npm)
- Nov 13, 2025
Malicious code in terser-rate-limiter-xanadu-palynology (npm)
- Nov 13, 2025
Malicious code in terser-postcss-loader-bunyan-celeste (npm)
- Nov 13, 2025
Malicious code in terser-isostasy-build-avior (npm)
- Nov 13, 2025
Malicious code in terser-antares-markdownlint-telesto (npm)
- Nov 13, 2025
Malicious code in terraforming-nebula-cordelia-virtualreality (npm)
- Nov 13, 2025
Malicious code in terraforming-filament-got-dione (npm)
- Nov 13, 2025
Malicious code in terraforming-astro-virgo-toml (npm)
- Nov 13, 2025
Malicious code in telesto-vulcan-chai-cressida (npm)
- Nov 13, 2025
Malicious code in telesto-typeorm-google-vuetify (npm)
- Nov 13, 2025
Malicious code in telesto-spectron-sagitta-soap (npm)
- Nov 13, 2025
Malicious code in telesto-redis-ophiuchus-radioastronomy (npm)
- Nov 13, 2025
Malicious code in telesto-publish-oberon-charon (npm)
- Nov 13, 2025
Malicious code in telesto-prettier-stylelint-cors-janus (npm)
- Nov 13, 2025
Malicious code in telesto-nova-zenobia-sublimation (npm)
- Nov 13, 2025
Malicious code in telesto-neptune-tethys-shelljs (npm)
- Nov 13, 2025
Malicious code in telesto-dotenv-safe-webdriver-mocha-jwt (npm)
- Nov 13, 2025
Malicious code in tectonophysics-transform-crust-sagitta (npm)
- Nov 13, 2025
Malicious code in tectonophysics-sequelize-whitedwarf-ultra (npm)
- Nov 13, 2025
Malicious code in tectonophysics-pegasus-neuromorphic-enceladus (npm)
- Nov 13, 2025
Malicious code in tectonophysics-paleoanthropology-pegasus-astrophysics (npm)
- Nov 13, 2025
Malicious code in tectonophysics-levels-zenith-karma (npm)
- Nov 13, 2025
Malicious code in tectonophysics-farout-cordelia-darkenergy (npm)
- Nov 13, 2025
Malicious code in tectonic-seismology-upgrade-commitizen (npm)
- Nov 13, 2025
Malicious code in tectonic-pino-pretty-build-elara (npm)
- Nov 13, 2025
Malicious code in tectonic-pegasus-axios-nashira (npm)
- Nov 13, 2025
Malicious code in tectonic-nightmare-archaeoastronomy-inflation (npm)
- Nov 13, 2025
Malicious code in technosignature-wezen-blitz-blazar (npm)
- Nov 13, 2025
Malicious code in technosignature-taphonomy-pino-wasat (npm)
- Nov 13, 2025
Malicious code in technosignature-quark-quito-slides (npm)
- Nov 13, 2025
Malicious code in technosignature-eslint-plugin-deimos-stop (npm)
- Nov 13, 2025
Malicious code in technocracy-spectron-webdriver-query-winston (npm)
Page 281 of 4,809