Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,450 total in npm · sorted newest first- Nov 13, 2025
Malicious code in proxima-kronos-charon-membrane (npm)
- Nov 13, 2025
Malicious code in proxima-hugo-pm2-phoebe (npm)
- Nov 13, 2025
Malicious code in proxima-farout-react-bootstrap-puppeteer (npm)
- Nov 13, 2025
Malicious code in proxima-dotenv-safe-carpo-release-it (npm)
- Nov 13, 2025
Malicious code in proxima-dagda-tethys-vuepress (npm)
- Nov 13, 2025
Malicious code in proxima-cli-galaxy-eslint (npm)
- Nov 13, 2025
Malicious code in proxima-bootes-library-halley (npm)
- Nov 13, 2025
Malicious code in proxima-auth0-eventhoriz-miranda (npm)
- Nov 13, 2025
Malicious code in proxima-antimatter-express-redis (npm)
- Nov 13, 2025
Malicious code in proxima-aether-quasar-xml (npm)
- Nov 13, 2025
Malicious code in protractor-xenos-aurora-holography (npm)
- Nov 13, 2025
Malicious code in protractor-wezen-repository-quantum (npm)
- Nov 13, 2025
Malicious code in protractor-stream-frontend-dynamo (npm)
- Nov 13, 2025
Malicious code in protractor-nightwatch-schema-bootstrap (npm)
- Nov 13, 2025
Malicious code in protractor-neptunology-less-grunt (npm)
- Nov 13, 2025
Malicious code in protractor-hercules-xenos-webdriverio (npm)
- Nov 13, 2025
Malicious code in protractor-farout-dorado-ariel (npm)
- Nov 13, 2025
Malicious code in protractor-eclipse-ini-subscription (npm)
- Nov 13, 2025
Malicious code in protractor-biotechnology-hercules-relay (npm)
- Nov 13, 2025
Malicious code in protoplanetarydisk-zenith-mysql-palynology (npm)
- Nov 13, 2025
Malicious code in protoplanetarydisk-thermochronology-zenobia-multiverse (npm)
- Nov 13, 2025
Malicious code in protoplanetarydisk-prettier-stylelint-jabbah-sagitta (npm)
- Nov 13, 2025
Malicious code in proteomics-zenobia-cosmology-quark (npm)
- Nov 13, 2025
Malicious code in proteomics-terraforming-exosphere-supernova (npm)
- Nov 13, 2025
Malicious code in proteomics-supernova-subduction-nightwatch (npm)
- Nov 13, 2025
Malicious code in proteomics-electron-triton-child-process (npm)
- Nov 13, 2025
Malicious code in protected-thread-cron-integer-alpha (npm)
- Nov 13, 2025
Malicious code in protected-table-sanitize-secure-void (npm)
- Nov 13, 2025
Malicious code in protected-reject-decrypt-bad-big (npm)
- Nov 13, 2025
Malicious code in protected-permission-table-warn-dog (npm)
- Nov 13, 2025
Malicious code in protected-old-compile-java-enum (npm)
- Nov 13, 2025
Malicious code in protected-link-fire-epsilon-await (npm)
- Nov 13, 2025
Malicious code in protected-cat-mu-file-async (npm)
- Nov 13, 2025
Malicious code in prosthetics-outercore-javascript-taphonomy (npm)
- Nov 13, 2025
Malicious code in prosthetics-local-canopus-uranology (npm)
- Nov 13, 2025
Malicious code in prosthetics-leda-mantle-deimos (npm)
- Nov 13, 2025
Malicious code in prosthetics-janus-cosmicray-spectron (npm)
- Nov 13, 2025
Malicious code in prosthetics-commitlint-astrobiology-io (npm)
- Nov 13, 2025
Malicious code in prompts-xanthus-blitz-eslint (npm)
- Nov 13, 2025
Malicious code in prompts-terser-webpack-plugin-enceladus-graviton (npm)
- Nov 13, 2025
Malicious code in prompts-spectron-firebase-frontend (npm)
- Nov 13, 2025
Malicious code in prompts-radiometric-passport-geoarchaeology (npm)
- Nov 13, 2025
Malicious code in prompts-meissa-lacerta-deneb (npm)
- Nov 13, 2025
Malicious code in prompts-jasmine-wolf-duplex (npm)
- Nov 13, 2025
Malicious code in prompts-flare-celeste-sedna (npm)
- Nov 13, 2025
Malicious code in prompts-commitlint-canopus-karma (npm)
- Nov 13, 2025
Malicious code in prompts-capella-node-config-biomimicry (npm)
- Nov 13, 2025
Malicious code in promise-yonder-lint-pyxis (npm)
- Nov 13, 2025
Malicious code in promise-vortex-technocracy-transform (npm)
- Nov 13, 2025
Malicious code in promise-user-static-small-stack (npm)
Page 301 of 4,809