Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in omicron-route-beta-virtualize-void (npm)
- Nov 13, 2025
Malicious code in omicron-query-air-cold-kappa (npm)
- Nov 13, 2025
Malicious code in omicron-module-export-java-bundle (npm)
- Nov 13, 2025
Malicious code in omicron-final-fire-export-star (npm)
- Nov 13, 2025
Malicious code in omicron-enum-link-permission-double (npm)
- Nov 13, 2025
Malicious code in omicron-bundle-file-final-warn (npm)
- Nov 13, 2025
Malicious code in omega-xml-proxy-runtime-analyze (npm)
- Nov 13, 2025
Malicious code in omega-test-benchmark-validate-resolve (npm)
- Nov 13, 2025
Malicious code in omega-string-view-double-warn (npm)
- Nov 13, 2025
Malicious code in omega-fast-xi-node-analyze (npm)
- Nov 13, 2025
Malicious code in omega-big-zero-export-java (npm)
- Nov 13, 2025
Malicious code in old-stub-xml-deploy-wind (npm)
- Nov 13, 2025
Malicious code in old-string-protected-omega-decode (npm)
- Nov 13, 2025
Malicious code in old-reject-mu-char-decrypt (npm)
- Nov 13, 2025
Malicious code in old-import-decode-table-process (npm)
- Nov 13, 2025
Malicious code in old-grid-permission-gamma-web (npm)
- Nov 13, 2025
Malicious code in old-export-class-cron-deploy (npm)
- Nov 13, 2025
Malicious code in old-decompress-scale-throw-user (npm)
- Nov 13, 2025
Malicious code in odin-toml-element-ui-flare (npm)
- Nov 13, 2025
Malicious code in odin-start-sagitta-got (npm)
- Nov 13, 2025
Malicious code in odin-nightwatch-singularity-gravity (npm)
- Nov 13, 2025
Malicious code in odin-mensa-magnetar-react-bootstrap (npm)
- Nov 13, 2025
Malicious code in odin-lepton-superagent-uninstall (npm)
- Nov 13, 2025
Malicious code in odin-holography-wavefunction-webpack (npm)
- Nov 13, 2025
Malicious code in odin-fetch-arcturus-cressida (npm)
- Nov 13, 2025
Malicious code in odin-baryon-primatology-equinox (npm)
- Nov 13, 2025
Malicious code in odin-babel-ignite-abiogenesis (npm)
- Nov 13, 2025
Malicious code in octans-yakutsk-dotenv-leda (npm)
- Nov 13, 2025
Malicious code in octans-sedna-entanglement-xerxes (npm)
- Nov 13, 2025
Malicious code in octans-prompts-hyperion-google (npm)
- Nov 13, 2025
Malicious code in octans-parallax-webdriverio-innercore (npm)
- Nov 13, 2025
Malicious code in octans-non-blocking-repository-cosmiconfig (npm)
- Nov 13, 2025
Malicious code in octans-eigenstate-antares-vuetify (npm)
- Nov 13, 2025
Malicious code in octans-cybernetics-carpo-norma (npm)
- Nov 13, 2025
Malicious code in octans-command-io-command (npm)
- Nov 13, 2025
Malicious code in octans-buffer-commitlint-config-angular-puppeteer (npm)
- Nov 13, 2025
Malicious code in object-rain-fast-process-unix (npm)
- Nov 13, 2025
Malicious code in object-chi-yaml-authorize-zero (npm)
- Nov 13, 2025
Malicious code in object-authorize-array-cluster-encrypt (npm)
- Nov 13, 2025
Malicious code in oberon-semantic-ui-cors-dione (npm)
- Nov 13, 2025
Malicious code in oberon-mdx-hydrogeology-bunyan (npm)
- Nov 13, 2025
Malicious code in oberon-geochronology-yakutsk-neuromorphic (npm)
- Nov 13, 2025
Malicious code in oauth-zenobia-mechatronics-sirius (npm)
- Nov 13, 2025
Malicious code in oauth-neptunology-lint-server (npm)
- Nov 13, 2025
Malicious code in nuxtjs-test-fornax-postgres (npm)
- Nov 13, 2025
Malicious code in nuxtjs-steganography-dynamo-rocket (npm)
- Nov 13, 2025
Malicious code in nuxtjs-quasarjet-cross-env-taurus (npm)
- Nov 13, 2025
Malicious code in nuxtjs-ionosphere-parsec-cosmology (npm)
- Nov 13, 2025
Malicious code in nuxtjs-hugo-karma-antares (npm)
- Nov 13, 2025
Malicious code in nuxtjs-heka-google-quasar (npm)
Page 315 of 4,814