Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,446 total in npm · sorted newest first- Nov 13, 2025
Malicious code in telesto-vulcan-chai-cressida (npm)
- Nov 13, 2025
Malicious code in telesto-typeorm-google-vuetify (npm)
- Nov 13, 2025
Malicious code in telesto-spectron-sagitta-soap (npm)
- Nov 13, 2025
Malicious code in telesto-redis-ophiuchus-radioastronomy (npm)
- Nov 13, 2025
Malicious code in telesto-publish-oberon-charon (npm)
- Nov 13, 2025
Malicious code in telesto-prettier-stylelint-cors-janus (npm)
- Nov 13, 2025
Malicious code in telesto-nova-zenobia-sublimation (npm)
- Nov 13, 2025
Malicious code in telesto-neptune-tethys-shelljs (npm)
- Nov 13, 2025
Malicious code in telesto-dotenv-safe-webdriver-mocha-jwt (npm)
- Nov 13, 2025
Malicious code in tectonophysics-transform-crust-sagitta (npm)
- Nov 13, 2025
Malicious code in tectonophysics-sequelize-whitedwarf-ultra (npm)
- Nov 13, 2025
Malicious code in tectonophysics-pegasus-neuromorphic-enceladus (npm)
- Nov 13, 2025
Malicious code in tectonophysics-paleoanthropology-pegasus-astrophysics (npm)
- Nov 13, 2025
Malicious code in tectonophysics-levels-zenith-karma (npm)
- Nov 13, 2025
Malicious code in tectonophysics-farout-cordelia-darkenergy (npm)
- Nov 13, 2025
Malicious code in tectonic-seismology-upgrade-commitizen (npm)
- Nov 13, 2025
Malicious code in tectonic-pino-pretty-build-elara (npm)
- Nov 13, 2025
Malicious code in tectonic-pegasus-axios-nashira (npm)
- Nov 13, 2025
Malicious code in tectonic-nightmare-archaeoastronomy-inflation (npm)
- Nov 13, 2025
Malicious code in technosignature-wezen-blitz-blazar (npm)
- Nov 13, 2025
Malicious code in technosignature-taphonomy-pino-wasat (npm)
- Nov 13, 2025
Malicious code in technosignature-quark-quito-slides (npm)
- Nov 13, 2025
Malicious code in technosignature-eslint-plugin-deimos-stop (npm)
- Nov 13, 2025
Malicious code in technocracy-spectron-webdriver-query-winston (npm)
- Nov 13, 2025
Malicious code in technocracy-protoplanetarydisk-xanthus-javascript (npm)
- Nov 13, 2025
Malicious code in technocracy-neptunology-entanglement-whitedwarf (npm)
- Nov 13, 2025
Malicious code in technocracy-buffer-outercore-tethys (npm)
- Nov 13, 2025
Malicious code in taurus-winston-panspermia-neuromorphic (npm)
- Nov 13, 2025
Malicious code in taurus-webdriverio-helios-gemini (npm)
- Nov 13, 2025
Malicious code in taurus-request-hyperion-subduction (npm)
- Nov 13, 2025
Malicious code in taurus-mutation-izar-node-sass (npm)
- Nov 13, 2025
Malicious code in taurus-interferometry-global-ultra (npm)
- Nov 13, 2025
Malicious code in taurus-heliophysics-commitlint-config-angular-superposition (npm)
- Nov 13, 2025
Malicious code in taurus-firebase-vuepress-uninstall (npm)
- Nov 13, 2025
Malicious code in taurus-deimos-package-toml (npm)
- Nov 13, 2025
Malicious code in taurus-css-minimizer-webpack-plugin-ophiuchus-webdriverio (npm)
- Nov 13, 2025
Malicious code in taurus-configstore-delphinus-nightmare (npm)
- Nov 13, 2025
Malicious code in taurus-bootes-jekyll-neptune (npm)
- Nov 13, 2025
Malicious code in tau-upsilon-function-alpha-kernel (npm)
- Nov 13, 2025
Malicious code in tau-psi-theta-process-optimize (npm)
- Nov 13, 2025
Malicious code in tau-mu-good-beta-kappa (npm)
- Nov 13, 2025
Malicious code in tau-moon-scale-private-analyze (npm)
- Nov 13, 2025
Malicious code in tau-import-float-monitor-finally (npm)
- Nov 13, 2025
Malicious code in tau-import-file-bad-byte (npm)
- Nov 13, 2025
Malicious code in tau-fork-hot-web-big (npm)
- Nov 13, 2025
Malicious code in tau-float-string-reject-byte (npm)
- Nov 13, 2025
Malicious code in tau-data-grid-minify-function (npm)
- Nov 13, 2025
Malicious code in tardigrade-virgo-hologram-yaml (npm)
- Nov 13, 2025
Malicious code in tardigrade-perseus-scripts-csrf (npm)
- Nov 13, 2025
Malicious code in tardigrade-mini-css-extract-plugin-nightwatch-blueshift (npm)
Page 282 of 4,809