Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in paleoecology-tardigrade-express-rocket (npm)
- Nov 13, 2025
Malicious code in paleoecology-stop-javascript-google (npm)
- Nov 13, 2025
Malicious code in paleoecology-cygnus-jovian-telesto (npm)
- Nov 13, 2025
Malicious code in paleoecology-backend-hydrogeology-postcss-loader (npm)
- Nov 13, 2025
Malicious code in paleoclimatology-sagitta-hydra-geochronology (npm)
- Nov 13, 2025
Malicious code in paleoclimatology-paleoanthropology-supercluster-proxima (npm)
- Nov 13, 2025
Malicious code in paleoclimatology-outercore-neptune-nightmare (npm)
- Nov 13, 2025
Malicious code in paleoclimatology-nova-rollup-vortex (npm)
- Nov 13, 2025
Malicious code in paleoclimatology-node-sass-asteroid-pulsar (npm)
- Nov 13, 2025
Malicious code in paleoclimatology-jsonp-troposphere-nodejs (npm)
- Nov 13, 2025
Malicious code in paleoclimatology-izar-coronalmassejection-webdriver-mocha (npm)
- Nov 13, 2025
Malicious code in paleoclimatology-hydra-schema-genomics (npm)
- Nov 13, 2025
Malicious code in paleoclimatology-framework-mensa-spectron (npm)
- Nov 13, 2025
Malicious code in paleoclimatology-eventhoriz-areology-higgs (npm)
- Nov 13, 2025
Malicious code in paleoclimatology-draco-backend-triton (npm)
- Nov 13, 2025
Malicious code in paleoclimatology-cosmogenic-crust-kardashevscale (npm)
- Nov 13, 2025
Malicious code in paleoceanography-shelljs-umbriel-galaxy (npm)
- Nov 13, 2025
Malicious code in paleoceanography-sedna-axios-apollo (npm)
- Nov 13, 2025
Malicious code in paleobotany-warp-less-uranology (npm)
- Nov 13, 2025
Malicious code in paleobotany-perseus-draco-mensa (npm)
- Nov 13, 2025
Malicious code in paleobotany-nightwatch-epimetheus-spectroscopy (npm)
- Nov 13, 2025
Malicious code in paleobotany-janus-writable-cosmicweb (npm)
- Nov 13, 2025
Malicious code in paleobotany-commitlint-config-angular-ultra-nebula (npm)
- Nov 13, 2025
Malicious code in paleobotany-callback-magnetosphere-bellatrix (npm)
- Nov 13, 2025
Malicious code in paleoanthropology-helios-auth-panspermia (npm)
- Nov 13, 2025
Malicious code in package-zenobia-elektra-geodynamo (npm)
- Nov 13, 2025
Malicious code in package-uninstall-scorpius-react-bootstrap (npm)
- Nov 13, 2025
Malicious code in package-pyxis-cressida-kastra (npm)
- Nov 13, 2025
Malicious code in package-process-helios-markdown-pdf (npm)
- Nov 13, 2025
Malicious code in package-nconf-antares-quasar (npm)
- Nov 13, 2025
Malicious code in package-eventhoriz-gammarayburst-parsec (npm)
- Nov 13, 2025
Malicious code in package-changelog-css-loader-slidev (npm)
- Nov 13, 2025
Malicious code in outercore-sync-fornax-lightyear (npm)
- Nov 13, 2025
Malicious code in outercore-quasarjet-ora-saturnology (npm)
- Nov 13, 2025
Malicious code in outercore-cli-concurrently-troposphere (npm)
- Nov 13, 2025
Malicious code in oscillation-readable-supernova-karma (npm)
- Nov 13, 2025
Malicious code in oscillation-oscillation-accretion-comet (npm)
- Nov 13, 2025
Malicious code in oscillation-leda-warp-framework (npm)
- Nov 13, 2025
Malicious code in oscillation-grunt-magellan-dorado (npm)
- Nov 13, 2025
Malicious code in oscillation-aquarius-ursa-parallax (npm)
- Nov 13, 2025
Malicious code in orogeny-rollup-heka-miranda (npm)
- Nov 13, 2025
Malicious code in orogeny-quark-archaeoastronomy-auth (npm)
- Nov 13, 2025
Malicious code in orogeny-karma-babel-sequelize (npm)
- Nov 13, 2025
Malicious code in orogeny-fork-query-troposphere (npm)
- Nov 13, 2025
Malicious code in orogeny-fermion-mui-jovian (npm)
- Nov 13, 2025
Malicious code in orogeny-algol-kastra-xo (npm)
- Nov 13, 2025
Malicious code in orchestrate-web-simulate-float-abstract (npm)
- Nov 13, 2025
Malicious code in orchestrate-process-cache-data-async (npm)
- Nov 13, 2025
Malicious code in orchestrate-grid-dog-air-route (npm)
- Nov 13, 2025
Malicious code in orchestrate-benchmark-spy-air-cat (npm)
Page 313 of 4,814