Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,446 total in npm · sorted newest first- Nov 13, 2025
Malicious code in tardigrade-leda-jest-chakra-ui (npm)
- Nov 13, 2025
Malicious code in tardigrade-indus-baryon-axios (npm)
- Nov 13, 2025
Malicious code in taphonomy-quantum-juno-eridanus (npm)
- Nov 13, 2025
Malicious code in taphonomy-phoebe-mineralogy-cladistics (npm)
- Nov 13, 2025
Malicious code in taphonomy-phoebe-castor-terraforming (npm)
- Nov 13, 2025
Malicious code in taphonomy-neuromorphic-cressida-electron-builder (npm)
- Nov 13, 2025
Malicious code in taphonomy-commitlint-kardashevscale-loglevel (npm)
- Nov 13, 2025
Malicious code in tailwindcss-bunyan-spica-perseus (npm)
- Nov 13, 2025
Malicious code in tailwindcss-bulma-vuetify-zenobia (npm)
- Nov 13, 2025
Malicious code in tachyon-vortex-bellatrix-csv (npm)
- Nov 13, 2025
Malicious code in tachyon-string-version-sequelize (npm)
- Nov 13, 2025
Malicious code in tachyon-mesosphere-spinner-pm2 (npm)
- Nov 13, 2025
Malicious code in tachyon-lacerta-relay-mdx (npm)
- Nov 13, 2025
Malicious code in tachyon-asthenosphere-less-loader-dagda (npm)
- Nov 13, 2025
Malicious code in table-rho-deserialize-authorize-test (npm)
- Nov 13, 2025
Malicious code in table-report-book-quick-delta (npm)
- Nov 13, 2025
Malicious code in table-private-module-zero-fork (npm)
- Nov 13, 2025
Malicious code in table-old-sun-await-decode (npm)
- Nov 13, 2025
Malicious code in table-link-chi-grid-byte (npm)
- Nov 13, 2025
Malicious code in table-hash-long-delta-omicron (npm)
- Nov 13, 2025
Malicious code in table-authorize-authenticate-assert-pi (npm)
- Nov 13, 2025
Malicious code in table-alert-water-socket-visualize (npm)
- Nov 13, 2025
Malicious code in sync-vega-apex-prettier-plugin-markdown (npm)
- Nov 13, 2025
Malicious code in sync-uglify-js-rest-superagent (npm)
- Nov 13, 2025
Malicious code in sync-taurus-cluster-webpack (npm)
- Nov 13, 2025
Malicious code in sync-hugo-xanadu-module (npm)
- Nov 13, 2025
Malicious code in sync-decoherence-xanthus-express (npm)
- Nov 13, 2025
Malicious code in supervisor-winston-superagent-exosphere (npm)
- Nov 13, 2025
Malicious code in supervisor-slides-orbit-hyperion (npm)
- Nov 13, 2025
Malicious code in supervisor-helios-stream-rate-limiter (npm)
- Nov 13, 2025
Malicious code in supervisor-cosmology-element-ui-rigel (npm)
- Nov 13, 2025
Malicious code in supervisor-cosmicsilence-kardashevscale-ophiuchus (npm)
- Nov 13, 2025
Malicious code in supervisor-config-hapi-relay (npm)
- Nov 13, 2025
Malicious code in supervisor-adonis-epimetheus-rimraf (npm)
- Nov 13, 2025
Malicious code in superposition-unuk-spectroscopy-borealis (npm)
- Nov 13, 2025
Malicious code in superposition-quasar-iota-mysql (npm)
- Nov 13, 2025
Malicious code in superposition-nucleosynthesis-mui-rigel (npm)
- Nov 13, 2025
Malicious code in superposition-enif-genomics-australis (npm)
- Nov 13, 2025
Malicious code in superposition-elara-blazar-webdriverio (npm)
- Nov 13, 2025
Malicious code in superposition-brane-gravity-altair (npm)
- Nov 13, 2025
Malicious code in supernova-webdriver-mocha-centauri-vega (npm)
- Nov 13, 2025
Malicious code in supernova-saturnology-asteroid-halley (npm)
- Nov 13, 2025
Malicious code in supernova-phylogenetics-terser-abiogenesis (npm)
- Nov 13, 2025
Malicious code in supernova-miranda-ophiuchus-resonance (npm)
- Nov 13, 2025
Malicious code in supernova-hyperion-tailwindcss-optimize-css-assets-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in supernova-eridanus-radiant-yakutsk (npm)
- Nov 13, 2025
Malicious code in supernova-equinox-singularity-robotics (npm)
- Nov 13, 2025
Malicious code in supernova-dysonswarm-arcturus-solis (npm)
- Nov 13, 2025
Malicious code in supernova-cosmogenic-buffer-bioinformatics (npm)
- Nov 13, 2025
Malicious code in supernova-astrophysics-jekyll-webdriver-manager (npm)
Page 283 of 4,809