Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,450 total in npm · sorted newest first- Nov 13, 2025
Malicious code in release-it-juno-cypress-ganymede (npm)
- Nov 13, 2025
Malicious code in release-it-indus-promise-xml (npm)
- Nov 13, 2025
Malicious code in release-it-biogeochemistry-geoarchaeology-protractor (npm)
- Nov 13, 2025
Malicious code in release-it-apollo-norma-vuepress (npm)
- Nov 13, 2025
Malicious code in relay-yaml-markdown-cosmicsilence (npm)
- Nov 13, 2025
Malicious code in relay-xanadu-playwright-miranda (npm)
- Nov 13, 2025
Malicious code in relay-tardigrade-typeorm-cli (npm)
- Nov 13, 2025
Malicious code in relay-slides-kinetic-query (npm)
- Nov 13, 2025
Malicious code in relay-neutrino-procyon-stratigraphy (npm)
- Nov 13, 2025
Malicious code in relay-halley-ophiuchus-public (npm)
- Nov 13, 2025
Malicious code in relay-dotenv-chai-ophiuchus (npm)
- Nov 13, 2025
Malicious code in relay-development-update-semantic-release (npm)
- Nov 13, 2025
Malicious code in relay-dagda-sync-graviton (npm)
- Nov 13, 2025
Malicious code in reject-static-theta-info-try (npm)
- Nov 13, 2025
Malicious code in reject-report-water-thread-parse (npm)
- Nov 13, 2025
Malicious code in reject-process-link-cat-encrypt (npm)
- Nov 13, 2025
Malicious code in reject-finally-data-big-long (npm)
- Nov 13, 2025
Malicious code in reject-book-catch-module-short (npm)
- Nov 13, 2025
Malicious code in reject-await-hash-try-try (npm)
- Nov 13, 2025
Malicious code in rehype-sequelize-avior-redis (npm)
- Nov 13, 2025
Malicious code in rehype-mesosphere-orbit-puppeteer (npm)
- Nov 13, 2025
Malicious code in rehype-janus-nebula-quito (npm)
- Nov 13, 2025
Malicious code in rehype-darkenergy-neptune-taphonomy (npm)
- Nov 13, 2025
Malicious code in regulus-xenos-yonder-frontend (npm)
- Nov 13, 2025
Malicious code in regulus-winston-lepton-webdriver-mocha (npm)
- Nov 13, 2025
Malicious code in regulus-taurus-reveal-md-exoplanet (npm)
- Nov 13, 2025
Malicious code in regulus-stratosphere-gravity-ethology (npm)
- Nov 13, 2025
Malicious code in regulus-publish-development-parallax (npm)
- Nov 13, 2025
Malicious code in regulus-protoplanetarydisk-quito-kastra (npm)
- Nov 13, 2025
Malicious code in regulus-nova-resolvers-spinner (npm)
- Nov 13, 2025
Malicious code in regulus-node-sass-hugo-mensa (npm)
- Nov 13, 2025
Malicious code in regulus-eridanus-meissa-winston (npm)
- Nov 13, 2025
Malicious code in registry-ursa-prettier-plugin-markdown-framework (npm)
- Nov 13, 2025
Malicious code in registry-relay-electron-builder-vuetify (npm)
- Nov 13, 2025
Malicious code in registry-readable-nucleosynthesis-jsonp (npm)
- Nov 13, 2025
Malicious code in registry-quark-barnard-cross-env (npm)
- Nov 13, 2025
Malicious code in registry-pipe-version-chariklo (npm)
- Nov 13, 2025
Malicious code in registry-local-biotechnology-sagitta (npm)
- Nov 13, 2025
Malicious code in registry-firebase-bunyan-prettier (npm)
- Nov 13, 2025
Malicious code in registry-dione-halley-less (npm)
- Nov 13, 2025
Malicious code in registry-apex-seismology-ichnology (npm)
- Nov 13, 2025
Malicious code in refactor-socket-container-wind-sigma (npm)
- Nov 13, 2025
Malicious code in refactor-signal-float-code-char (npm)
- Nov 13, 2025
Malicious code in refactor-psi-xml-cold-sed (npm)
- Nov 13, 2025
Malicious code in refactor-private-table-finally-water (npm)
- Nov 13, 2025
Malicious code in refactor-file-sed-class-wind (npm)
- Nov 13, 2025
Malicious code in refactor-cron-yaml-dog-debug (npm)
- Nov 13, 2025
Malicious code in refactor-cat-epsilon-interface-monitor (npm)
- Nov 13, 2025
Malicious code in redshift-sagitta-geodynamo-planckscale (npm)
- Nov 13, 2025
Malicious code in redshift-run-script-chai-koa (npm)
Page 296 of 4,809