Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,446 total in npm · sorted newest first- Nov 13, 2025
Malicious code in static-public-omega-abstract-upsilon (npm)
- Nov 13, 2025
Malicious code in start-iota-webpack-cli (npm)
- Nov 13, 2025
Malicious code in start-io-nightwatch-install (npm)
- Nov 13, 2025
Malicious code in star-secure-alpha-omega-key (npm)
- Nov 13, 2025
Malicious code in star-route-query-export-process (npm)
- Nov 13, 2025
Malicious code in star-private-minify-bad-compress (npm)
- Nov 13, 2025
Malicious code in star-permission-parse-assert-small (npm)
- Nov 13, 2025
Malicious code in star-earth-small-execute-decrypt (npm)
- Nov 13, 2025
Malicious code in standard-thuban-commitlint-config-angular-got (npm)
- Nov 13, 2025
Malicious code in standard-seismology-sync-native (npm)
- Nov 13, 2025
Malicious code in standard-saturnology-webpack-pm2 (npm)
- Nov 13, 2025
Malicious code in standard-parallax-chalk-hologram (npm)
- Nov 13, 2025
Malicious code in standard-kuiperbelt-neuromorphic-sedimentology (npm)
- Nov 13, 2025
Malicious code in standard-frontend-glaciology-selenology (npm)
- Nov 13, 2025
Malicious code in standard-cygnus-quasarjet-joviology (npm)
- Nov 13, 2025
Malicious code in standard-browserify-petrology-oscillation (npm)
- Nov 13, 2025
Malicious code in standard-barnard-quark-yildun (npm)
- Nov 13, 2025
Malicious code in standard-apollo-tardigrade-perseus (npm)
- Nov 13, 2025
Malicious code in standard-altair-izar-sync (npm)
- Nov 13, 2025
Malicious code in stack-theta-meta-index-web (npm)
- Nov 13, 2025
Malicious code in stack-compress-nu-zeta-mock (npm)
- Nov 13, 2025
Malicious code in stack-bundle-public-air-user (npm)
- Nov 13, 2025
Malicious code in stack-authenticate-boolean-compile-kappa (npm)
- Nov 13, 2025
Malicious code in sqlite-winston-scripts-uninstall (npm)
- Nov 13, 2025
Malicious code in sqlite-telesto-commitlint-figures (npm)
- Nov 13, 2025
Malicious code in sqlite-oauth-quito-graphql (npm)
- Nov 13, 2025
Malicious code in sqlite-duplex-robotics-loglevel (npm)
- Nov 13, 2025
Malicious code in spy-visualize-array-spy-index (npm)
- Nov 13, 2025
Malicious code in spy-sun-byte-debug-import (npm)
- Nov 13, 2025
Malicious code in spy-fire-kappa-emulate-async (npm)
- Nov 13, 2025
Malicious code in spinner-uranology-terser-astrophysics (npm)
- Nov 13, 2025
Malicious code in spinner-spectron-electron-builder-loglevel (npm)
- Nov 13, 2025
Malicious code in spinner-rest-standard-writable (npm)
- Nov 13, 2025
Malicious code in spinner-proxima-cybernetics-cosmochemistry (npm)
- Nov 13, 2025
Malicious code in spinner-cryptography-acamar-elara (npm)
- Nov 13, 2025
Malicious code in spinner-command-solis-taphonomy (npm)
- Nov 13, 2025
Malicious code in spica-oberon-sirius-local (npm)
- Nov 13, 2025
Malicious code in spica-html-webpack-plugin-kronos-husky (npm)
- Nov 13, 2025
Malicious code in speleology-unuk-hydrogeology-supernova (npm)
- Nov 13, 2025
Malicious code in speleology-pipe-pino-puppeteer (npm)
- Nov 13, 2025
Malicious code in speleology-phenomic-nova-resonance (npm)
- Nov 13, 2025
Malicious code in speleology-ganymede-halley-panspermia (npm)
- Nov 13, 2025
Malicious code in spectroscopy-webdriver-manager-await-bootstrap (npm)
- Nov 13, 2025
Malicious code in spectroscopy-dotenv-cassini-sedimentology (npm)
- Nov 13, 2025
Malicious code in spectron-webdriver-nodemon-sedimentology-on (npm)
- Nov 13, 2025
Malicious code in spectron-webdriver-commitlint-apollo-mysql (npm)
- Nov 13, 2025
Malicious code in spectron-webdriver-async-primatology-canopus (npm)
- Nov 13, 2025
Malicious code in spectron-ursa-yonder-command (npm)
- Nov 13, 2025
Malicious code in spectron-pegasus-interstellarmedium-ultra (npm)
- Nov 13, 2025
Malicious code in spectron-neuromorphic-crust-inquirer (npm)
Page 286 of 4,809