Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,446 total in npm · sorted newest first- Nov 13, 2025
Malicious code in sedna-enif-fusion-colors (npm)
- Nov 13, 2025
Malicious code in sedimentology-spinner-gravity-blueshift (npm)
- Nov 13, 2025
Malicious code in sedimentology-ablation-meteor-xml (npm)
- Nov 13, 2025
Malicious code in sed-sigma-mock-finally-virtualize (npm)
- Nov 13, 2025
Malicious code in sed-sigma-encrypt-catch-warn (npm)
- Nov 13, 2025
Malicious code in sed-shell-cat-encrypt-parse (npm)
- Nov 13, 2025
Malicious code in sed-sed-link-data-root (npm)
- Nov 13, 2025
Malicious code in sed-secure-rain-water-omicron (npm)
- Nov 13, 2025
Malicious code in sed-route-encrypt-refactor-public (npm)
- Nov 13, 2025
Malicious code in sed-promise-book-sun-lambda (npm)
- Nov 13, 2025
Malicious code in sed-node-shell-long-authorize (npm)
- Nov 13, 2025
Malicious code in sed-float-bad-void-stack (npm)
- Nov 13, 2025
Malicious code in secure-phi-web-yaml-socket (npm)
- Nov 13, 2025
Malicious code in secure-old-deploy-resolve-encode (npm)
- Nov 13, 2025
Malicious code in secure-eta-throw-index-fork (npm)
- Nov 13, 2025
Malicious code in secure-compress-phi-bash-orchestrate (npm)
- Nov 13, 2025
Malicious code in secure-big-user-unix-private (npm)
- Nov 13, 2025
Malicious code in scripts-yaml-janus-gacrux (npm)
- Nov 13, 2025
Malicious code in scripts-thermochronology-corvus-stop (npm)
- Nov 13, 2025
Malicious code in scripts-shelljs-quark-gridsome (npm)
- Nov 13, 2025
Malicious code in scripts-private-frontend-fornax (npm)
- Nov 13, 2025
Malicious code in scripts-octans-redis-technosignature (npm)
- Nov 13, 2025
Malicious code in scripts-jabbah-apollo-phenomic (npm)
- Nov 13, 2025
Malicious code in scripts-hermes-pulsar-neuromorphic (npm)
- Nov 13, 2025
Malicious code in scripts-geckodriver-jwt-draco (npm)
- Nov 13, 2025
Malicious code in scripts-duplex-innercore-mongoose (npm)
- Nov 13, 2025
Malicious code in scripts-chalk-nodemon-eigenstate (npm)
- Nov 13, 2025
Malicious code in scripts-apex-gravity-jest (npm)
- Nov 13, 2025
Malicious code in scorpius-vulcan-postcss-loader-centauri (npm)
- Nov 13, 2025
Malicious code in scorpius-version-convict-private (npm)
- Nov 13, 2025
Malicious code in scorpius-gemini-ionosphere-odin (npm)
- Nov 13, 2025
Malicious code in scorpius-elara-membrane-brane (npm)
- Nov 13, 2025
Malicious code in scorpius-cryptography-tethys-library (npm)
- Nov 13, 2025
Malicious code in scorpius-chalk-eleventy-kaus (npm)
- Nov 13, 2025
Malicious code in schema-wasat-development-bellatrix (npm)
- Nov 13, 2025
Malicious code in schema-terser-prompts-rollup (npm)
- Nov 13, 2025
Malicious code in schema-dependencies-paleoanthropology-xenos (npm)
- Nov 13, 2025
Malicious code in schema-bunyan-magnetar-bootstrap (npm)
- Nov 13, 2025
Malicious code in scale-phi-deserialize-nu-sed (npm)
- Nov 13, 2025
Malicious code in scale-parse-await-book-private (npm)
- Nov 13, 2025
Malicious code in scale-hot-tree-cache-execute (npm)
- Nov 13, 2025
Malicious code in scale-deserialize-function-optimize-hot (npm)
- Nov 13, 2025
Malicious code in scale-deploy-pi-simulate-load (npm)
- Nov 13, 2025
Malicious code in scale-compress-minify-wind-interface (npm)
- Nov 13, 2025
Malicious code in saturnology-webdriver-mocha-registry-blitz (npm)
- Nov 13, 2025
Malicious code in saturnology-titan-solis-astrometry (npm)
- Nov 13, 2025
Malicious code in saturnology-fusion-kinetic-astrophysics (npm)
- Nov 13, 2025
Malicious code in saturnology-fomalhaut-geckodriver-resolvers (npm)
- Nov 13, 2025
Malicious code in saturnology-equinox-cordelia-wavefunction (npm)
- Nov 13, 2025
Malicious code in saturnology-enceladus-jest-xml (npm)
Page 291 of 4,809