Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in orchestrate-awk-encrypt-moon-fork (npm)
- Nov 13, 2025
Malicious code in orbit-zenith-magellan-antares (npm)
- Nov 13, 2025
Malicious code in orbit-typeorm-nucleosynthesis-tectonic (npm)
- Nov 13, 2025
Malicious code in orbit-publish-dynamo-helmet (npm)
- Nov 13, 2025
Malicious code in orbit-luna-indus-xanthus (npm)
- Nov 13, 2025
Malicious code in orbit-library-blueshift-vortex (npm)
- Nov 13, 2025
Malicious code in orbit-html-webpack-plugin-xml-docusaurus (npm)
- Nov 13, 2025
Malicious code in orbit-css-minimizer-webpack-plugin-paleontology-centaurus (npm)
- Nov 13, 2025
Malicious code in orbit-cosmicweb-meteor-wolf (npm)
- Nov 13, 2025
Malicious code in ora-release-it-ichnology-subscription (npm)
- Nov 13, 2025
Malicious code in ora-process-config-public (npm)
- Nov 13, 2025
Malicious code in ora-polaris-uranology-planckscale (npm)
- Nov 13, 2025
Malicious code in optimize-uglify-cluster-string-refactor (npm)
- Nov 13, 2025
Malicious code in optimize-theta-process-cluster-dog (npm)
- Nov 13, 2025
Malicious code in optimize-report-pi-module-hash (npm)
- Nov 13, 2025
Malicious code in optimize-proxy-alpha-cache-decompress (npm)
- Nov 13, 2025
Malicious code in optimize-pipe-signal-dog-index (npm)
- Nov 13, 2025
Malicious code in optimize-double-nu-cluster-function (npm)
- Nov 13, 2025
Malicious code in optimize-daemon-scale-char-test (npm)
- Nov 13, 2025
Malicious code in optimize-css-assets-webpack-plugin-terser-rollup-plugin-registry (npm)
- MAL-2025-188451Malwarenpmoptimize-css-assets-webpack-plugin-style-loader-bellatrix-prettier-stylelintNov 13, 2025
Malicious code in optimize-css-assets-webpack-plugin-style-loader-bellatrix-prettier-stylelint (npm)
- Nov 13, 2025
Malicious code in optimize-css-assets-webpack-plugin-polaris-docusaurus-andromeda (npm)
- Nov 13, 2025
Malicious code in optimize-css-assets-webpack-plugin-pm2-lyra-miranda (npm)
- Nov 13, 2025
Malicious code in optimize-cache-static-orchestrate-import (npm)
- Nov 13, 2025
Malicious code in ophiuchus-yonder-magellan-remark (npm)
- Nov 13, 2025
Malicious code in ophiuchus-whitedwarf-sirius-altair (npm)
- Nov 13, 2025
Malicious code in ophiuchus-vuetify-schema-ursa (npm)
- Nov 13, 2025
Malicious code in ophiuchus-spectron-webdriver-sedna-halley (npm)
- Nov 13, 2025
Malicious code in ophiuchus-sirius-biomimicry-loop (npm)
- Nov 13, 2025
Malicious code in ophiuchus-polaris-mineralogy-proteomics (npm)
- Nov 13, 2025
Malicious code in ophiuchus-europa-charon-blitz (npm)
- Nov 13, 2025
Malicious code in ophiuchus-eleventy-fornax-proxima (npm)
- Nov 13, 2025
Malicious code in ophiuchus-dactyl-elara-proxima (npm)
- Nov 13, 2025
Malicious code in ophiuchus-corvus-stream-deimos (npm)
- Nov 13, 2025
Malicious code in ophiuchus-callisto-semantic-ui-lynx (npm)
- Nov 13, 2025
Malicious code in ophiuchus-bunyan-exobiology-biotechnology (npm)
- Nov 13, 2025
Malicious code in ophiuchus-bootstrap-perseus-airbnb (npm)
- Nov 13, 2025
Malicious code in ophiuchus-blueshift-virtualreality-acamar (npm)
- Nov 13, 2025
Malicious code in oortcloud-zephyr-kinetic-acamar (npm)
- Nov 13, 2025
Malicious code in oortcloud-lint-weywot-luna (npm)
- Nov 13, 2025
Malicious code in oortcloud-css-minimizer-webpack-plugin-config-cryovolcano (npm)
- Nov 13, 2025
Malicious code in oortcloud-chariklo-geoarchaeology-cli (npm)
- Nov 13, 2025
Malicious code in on-xanthus-panspermia-kastra (npm)
- Nov 13, 2025
Malicious code in on-quantumfoam-nebula-cosmicweb (npm)
- Nov 13, 2025
Malicious code in on-planckscale-sequelize-comet (npm)
- Nov 13, 2025
Malicious code in on-graviton-async-antares (npm)
- Nov 13, 2025
Malicious code in on-eigenstate-eslint-plugin-axios (npm)
- Nov 13, 2025
Malicious code in on-cladistics-exosphere-stream (npm)
- Nov 13, 2025
Malicious code in omicron-thread-report-query-book (npm)
- Nov 13, 2025
Malicious code in omicron-short-water-easy-beta (npm)
Page 314 of 4,814