Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,446 total in npm · sorted newest first- Nov 13, 2025
Malicious code in subduction-middleware-javascript-supernova (npm)
- Nov 13, 2025
Malicious code in subduction-exec-redis-gatsby (npm)
- Nov 13, 2025
Malicious code in subduction-cosmology-hercules-cosmicweb (npm)
- Nov 13, 2025
Malicious code in style-loader-node-sass-graphql-nashira (npm)
- Nov 13, 2025
Malicious code in style-loader-lint-commitlint-config-angular-bootstrap (npm)
- Nov 13, 2025
Malicious code in stub-scale-alpha-epsilon-optimize (npm)
- Nov 13, 2025
Malicious code in stub-query-psi-throw-secure (npm)
- Nov 13, 2025
Malicious code in stub-encode-object-meta-info (npm)
- Nov 13, 2025
Malicious code in stub-emulate-decompress-view-sandbox (npm)
- Nov 13, 2025
Malicious code in string-version-oauth-epimetheus (npm)
- Nov 13, 2025
Malicious code in string-route-theta-virtualize-deserialize (npm)
- Nov 13, 2025
Malicious code in string-optimize-class-link-authorize (npm)
- Nov 13, 2025
Malicious code in string-index-dog-abstract-simple (npm)
- Nov 13, 2025
Malicious code in string-eslint-antd-cosmology (npm)
- Nov 13, 2025
Malicious code in string-epimetheus-neptunology-vulcan (npm)
- Nov 13, 2025
Malicious code in string-deneb-string-spectroscopy (npm)
- Nov 13, 2025
Malicious code in string-crust-exoplanet-centauri (npm)
- Nov 13, 2025
Malicious code in string-container-benchmark-phi-cat (npm)
- Nov 13, 2025
Malicious code in string-compile-module-benchmark-report (npm)
- Nov 13, 2025
Malicious code in string-beta-benchmark-scale-file (npm)
- Nov 13, 2025
Malicious code in string-avior-heliophysics-tachyon (npm)
- Nov 13, 2025
Malicious code in stream-yildun-bootes-neutrino (npm)
- Nov 13, 2025
Malicious code in stream-sequelize-writable-local (npm)
- Nov 13, 2025
Malicious code in stream-redis-bellatrix-oscillation (npm)
- Nov 13, 2025
Malicious code in stream-polaris-json-ursa (npm)
- Nov 13, 2025
Malicious code in stream-janus-soap-juno (npm)
- Nov 13, 2025
Malicious code in stream-indus-dendrochronology-run-script (npm)
- Nov 13, 2025
Malicious code in stream-ichnology-plutology-hermes (npm)
- Nov 13, 2025
Malicious code in stream-build-ganymede-corvus (npm)
- Nov 13, 2025
Malicious code in stream-andromeda-proxima-loglevel (npm)
- Nov 13, 2025
Malicious code in stratosphere-speleology-rollup-plugin-hapi (npm)
- Nov 13, 2025
Malicious code in stratosphere-spectron-webdriver-deimos-dynamo (npm)
- Nov 13, 2025
Malicious code in stratosphere-outercore-carpo-adonis (npm)
- Nov 13, 2025
Malicious code in stratigraphy-stream-module-deneb (npm)
- Nov 13, 2025
Malicious code in stratigraphy-helios-janus-electron-builder (npm)
- Nov 13, 2025
Malicious code in stratigraphy-castor-subduction-thermochronology (npm)
- Nov 13, 2025
Malicious code in stratigraphy-archaeogenetics-pino-figures (npm)
- Nov 13, 2025
Malicious code in stop-prompts-fusion-private (npm)
- Nov 13, 2025
Malicious code in stop-cressida-prompts-quasar (npm)
- Nov 13, 2025
Malicious code in stop-chalk-build-less-loader (npm)
- Nov 13, 2025
Malicious code in stop-callback-wezen-quark (npm)
- Nov 13, 2025
Malicious code in stop-auth-epigenetics-neutronstar (npm)
- Nov 13, 2025
Malicious code in stop-apex-singularity-nightmare (npm)
- Nov 13, 2025
Malicious code in steganography-yaml-quark-geochronology (npm)
- Nov 13, 2025
Malicious code in steganography-hadron-stratosphere-polaris (npm)
- Nov 13, 2025
Malicious code in steganography-aether-on-envconfig (npm)
- Nov 13, 2025
Malicious code in static-view-warn-cluster-catch (npm)
- Nov 13, 2025
Malicious code in static-transpile-sanitize-emulate-parse (npm)
- Nov 13, 2025
Malicious code in static-stub-dog-epsilon-final (npm)
- Nov 13, 2025
Malicious code in static-refactor-grep-yaml-emulate (npm)
Page 285 of 4,809