Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,450 total in npm · sorted newest first- Nov 13, 2025
Malicious code in polaris-octans-bootstrap-bootstrap (npm)
- Nov 13, 2025
Malicious code in polaris-juno-taphonomy-membrane (npm)
- Nov 13, 2025
Malicious code in polaris-interferometry-sails-convict (npm)
- Nov 13, 2025
Malicious code in polaris-build-event-dotenv-parse-variables (npm)
- Nov 13, 2025
Malicious code in polaris-backend-rollup-asthenosphere (npm)
- Nov 13, 2025
Malicious code in polaris-asteroid-oscillation-australis (npm)
- Nov 13, 2025
Malicious code in pm2-gridsome-playwright-init (npm)
- Nov 13, 2025
Malicious code in pm2-dorado-lithosphere-gravitationalwave (npm)
- Nov 13, 2025
Malicious code in pm2-development-postcss-callback (npm)
- Nov 13, 2025
Malicious code in plutology-sass-loader-mongoose-extremophile (npm)
- Nov 13, 2025
Malicious code in plutology-release-it-despina-arcturus (npm)
- Nov 13, 2025
Malicious code in plutology-meteor-xerxes-readable (npm)
- Nov 13, 2025
Malicious code in plutology-fusion-interstellarmedium-miranda (npm)
- Nov 13, 2025
Malicious code in plutology-cosmicray-fornax-babel (npm)
- Nov 13, 2025
Malicious code in plutology-async-firebase-run-script (npm)
- Nov 13, 2025
Malicious code in plutology-ariel-subscription-meissa (npm)
- Nov 13, 2025
Malicious code in plutology-alphard-achernar-antd (npm)
- Nov 13, 2025
Malicious code in playwright-wormhole-phylogenetics-inflation (npm)
- Nov 13, 2025
Malicious code in playwright-sqlite-neptunology-quasar (npm)
- Nov 13, 2025
Malicious code in playwright-rimraf-version-coronalmassejection (npm)
- Nov 13, 2025
Malicious code in playwright-quasar-tachyon-thuban (npm)
- Nov 13, 2025
Malicious code in playwright-phylogenetics-eigenstate-hexo (npm)
- Nov 13, 2025
Malicious code in playwright-dotenv-parse-variables-parcel-less (npm)
- Nov 13, 2025
Malicious code in playwright-asthenosphere-norma-cassini (npm)
- Nov 13, 2025
Malicious code in planetology-virgo-archaeometry-envconfig (npm)
- Nov 13, 2025
Malicious code in planetology-stratosphere-library-csrf (npm)
- Nov 13, 2025
Malicious code in planetology-sociobiology-spawn-deimos (npm)
- Nov 13, 2025
Malicious code in planetology-phenomic-accretion-galaxy (npm)
- Nov 13, 2025
Malicious code in planetology-neptune-bellatrix-on (npm)
- Nov 13, 2025
Malicious code in planetology-deneb-betelgeuse-ini (npm)
- Nov 13, 2025
Malicious code in planetology-borealis-nashira-celeste (npm)
- Nov 13, 2025
Malicious code in planetology-biogeochemistry-areology-equinox (npm)
- Nov 13, 2025
Malicious code in planckscale-webpack-json-neptunology (npm)
- Nov 13, 2025
Malicious code in planckscale-ora-envconfig-antares (npm)
- Nov 13, 2025
Malicious code in planckscale-lynx-global-transform (npm)
- Nov 13, 2025
Malicious code in planckscale-augmentedreality-relay-planckscale (npm)
- Nov 13, 2025
Malicious code in pipe-wavefunction-test-redis (npm)
- Nov 13, 2025
Malicious code in pipe-virgo-perseus-auth (npm)
- Nov 13, 2025
Malicious code in pipe-simple-virtualize-void-stack (npm)
- Nov 13, 2025
Malicious code in pipe-resolve-signal-uglify-eta (npm)
- Nov 13, 2025
Malicious code in pipe-pino-pretty-toml-meteor (npm)
- Nov 13, 2025
Malicious code in pipe-parallax-build-kinetic (npm)
- Nov 13, 2025
Malicious code in pipe-orogeny-await-kaus (npm)
- Nov 13, 2025
Malicious code in pipe-oortcloud-void-volcanology (npm)
- Nov 13, 2025
Malicious code in pipe-grid-byte-old-array (npm)
- Nov 13, 2025
Malicious code in pipe-got-filament-xenon (npm)
- Nov 13, 2025
Malicious code in pipe-final-tree-emulate-byte (npm)
- Nov 13, 2025
Malicious code in pipe-cz-conventional-changelog-meissa-canopus (npm)
- Nov 13, 2025
Malicious code in pipe-cloud-try-assert-grid (npm)
- Nov 13, 2025
Malicious code in pipe-byte-spy-fork-notify (npm)
Page 304 of 4,809