Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,446 total in npm · sorted newest first- Nov 13, 2025
Malicious code in singularity-restart-helmet-auriga (npm)
- Nov 13, 2025
Malicious code in singularity-kuiperbelt-loopback-fermiparadox (npm)
- Nov 13, 2025
Malicious code in singularity-darkmatter-janus-browserify (npm)
- Nov 13, 2025
Malicious code in singularity-bunyan-eslint-config-publish (npm)
- Nov 13, 2025
Malicious code in singularitarianism-prosthetics-wolf-exosphere (npm)
- Nov 13, 2025
Malicious code in singularitarianism-interferometry-cryovolcano-mocha (npm)
- Nov 13, 2025
Malicious code in singularitarianism-europa-spectroscopy-lithosphere (npm)
- Nov 13, 2025
Malicious code in simulate-small-enum-protected-cluster (npm)
- Nov 13, 2025
Malicious code in simulate-refactor-java-route-beta (npm)
- Nov 13, 2025
Malicious code in simple-load-info-error-cold (npm)
- Nov 13, 2025
Malicious code in simple-file-omicron-function-decrypt (npm)
- Nov 13, 2025
Malicious code in simple-await-try-book-epsilon (npm)
- Nov 13, 2025
Malicious code in signal-view-stub-interface-async (npm)
- Nov 13, 2025
Malicious code in signal-throw-pi-sun-sigma (npm)
- Nov 13, 2025
Malicious code in signal-star-benchmark-report-small (npm)
- Nov 13, 2025
Malicious code in signal-quick-proxy-data-web (npm)
- Nov 13, 2025
Malicious code in signal-authenticate-cluster-await-byte (npm)
- Nov 13, 2025
Malicious code in signal-array-report-reject-cat (npm)
- Nov 13, 2025
Malicious code in sigma-web-unix-interpret-earth (npm)
- Nov 13, 2025
Malicious code in sigma-try-deserialize-slow-omega (npm)
- Nov 13, 2025
Malicious code in sigma-rain-omicron-emulate-char (npm)
- Nov 13, 2025
Malicious code in sigma-query-interpret-phi-process (npm)
- Nov 13, 2025
Malicious code in sigma-file-signal-log-report (npm)
- Nov 13, 2025
Malicious code in sigma-compile-simulate-integer-bash (npm)
- Nov 13, 2025
Malicious code in sigma-class-new-root-reject (npm)
- Nov 13, 2025
Malicious code in sigma-byte-minify-cache-float (npm)
- Nov 13, 2025
Malicious code in sigma-awk-abstract-error-kappa (npm)
- Nov 13, 2025
Malicious code in short-shell-data-private-bash (npm)
- Nov 13, 2025
Malicious code in short-public-permission-grid-throw (npm)
- Nov 13, 2025
Malicious code in short-load-user-slow-easy (npm)
- Nov 13, 2025
Malicious code in short-encrypt-root-visualize-visualize (npm)
- Nov 13, 2025
Malicious code in short-easy-epsilon-beta-container (npm)
- Nov 13, 2025
Malicious code in short-easy-cat-mock-daemon (npm)
- Nov 13, 2025
Malicious code in shelljs-zephyr-ariel-brane (npm)
- Nov 13, 2025
Malicious code in shelljs-test-mira-neptune (npm)
- Nov 13, 2025
Malicious code in shelljs-package-writable-jabbah (npm)
- Nov 13, 2025
Malicious code in shelljs-fermiparadox-bootes-xml (npm)
- Nov 13, 2025
Malicious code in shelljs-biotechnology-leda-europa (npm)
- Nov 13, 2025
Malicious code in shell-process-eta-star-omicron (npm)
- Nov 13, 2025
Malicious code in shell-omicron-dog-bash-simple (npm)
- Nov 13, 2025
Malicious code in shell-integer-optimize-log-promise (npm)
- Nov 13, 2025
Malicious code in shell-double-gamma-shell-kappa (npm)
- Nov 13, 2025
Malicious code in shell-class-encrypt-info-zeta (npm)
- Nov 13, 2025
Malicious code in server-weywot-ablation-ablation (npm)
- Nov 13, 2025
Malicious code in server-redis-umbra-fornax (npm)
- Nov 13, 2025
Malicious code in server-publish-ultra-ultra (npm)
- Nov 13, 2025
Malicious code in server-nestjs-selenium-cassini (npm)
- Nov 13, 2025
Malicious code in server-nebula-cosmiconfig-umbra (npm)
- Nov 13, 2025
Malicious code in server-filament-framework-css-minimizer-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in server-child-process-cosmicray-extremophile (npm)
Page 289 of 4,809