Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in node-sass-nashira-xerxes-css-minimizer-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in node-sass-mutation-cladistics-helios (npm)
- Nov 13, 2025
Malicious code in node-sass-luna-ora-terser-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in node-sass-kastra-bellatrix-express (npm)
- Nov 13, 2025
Malicious code in node-sass-ignite-dotenv-safe-neptunology (npm)
- Nov 13, 2025
Malicious code in node-sass-eslint-kaus-relay (npm)
- Nov 13, 2025
Malicious code in node-sass-commitlint-lynx-public (npm)
- Nov 13, 2025
Malicious code in node-sass-blitz-paleobotany-decoherence (npm)
- Nov 13, 2025
Malicious code in node-optimize-table-alpha-final (npm)
- Nov 13, 2025
Malicious code in node-mu-private-new-runtime (npm)
- Nov 13, 2025
Malicious code in node-config-pulsar-buffer-luna (npm)
- Nov 13, 2025
Malicious code in node-config-private-zenobia-perseus (npm)
- Nov 13, 2025
Malicious code in node-config-phoenix-regulus-html-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in node-config-mini-css-extract-plugin-bellatrix-update (npm)
- Nov 13, 2025
Malicious code in node-config-lynx-cressida-hermes (npm)
- Nov 13, 2025
Malicious code in node-config-hexo-version-indus (npm)
- Nov 13, 2025
Malicious code in node-config-cross-env-event-fomalhaut (npm)
- Nov 13, 2025
Malicious code in node-config-commitlint-panspermia-superposition (npm)
- Nov 13, 2025
Malicious code in node-config-callisto-comet-eslint-plugin (npm)
- Nov 13, 2025
Malicious code in node-bundle-omega-deploy-sandbox (npm)
- Nov 13, 2025
Malicious code in node-awk-resolve-dog-public (npm)
- Nov 13, 2025
Malicious code in nightwatch-wolf-kastra-seismology (npm)
- Nov 13, 2025
Malicious code in nightwatch-ursa-rollup-plugin-slidev (npm)
- Nov 13, 2025
Malicious code in nightwatch-supervisor-hyperion-meissa (npm)
- Nov 13, 2025
Malicious code in nightwatch-supercluster-zooarchaeology-redgiant (npm)
- Nov 13, 2025
Malicious code in nightwatch-spawn-leda-tool (npm)
- Nov 13, 2025
Malicious code in nightwatch-server-pino-pretty-cz-conventional-changelog (npm)
- Nov 13, 2025
Malicious code in nightwatch-sedna-cosmiconfig-duplex (npm)
- Nov 13, 2025
Malicious code in nightwatch-restart-corvus-arcturus (npm)
- Nov 13, 2025
Malicious code in nightwatch-procyon-stream-docusaurus (npm)
- Nov 13, 2025
Malicious code in nightwatch-ophiuchus-request-quito (npm)
- Nov 13, 2025
Malicious code in nightwatch-nashira-wavefunction-perturbation (npm)
- Nov 13, 2025
Malicious code in nightwatch-loopback-delphinus-ursa (npm)
- Nov 13, 2025
Malicious code in nightwatch-levels-lepton-phoebe (npm)
- Nov 13, 2025
Malicious code in nightwatch-javascript-kastra-antares (npm)
- Nov 13, 2025
Malicious code in nightwatch-interferometry-meteor-decoherence (npm)
- Nov 13, 2025
Malicious code in nightwatch-global-subduction-eslint-plugin (npm)
- Nov 13, 2025
Malicious code in nightwatch-firebase-janus-package (npm)
- Nov 13, 2025
Malicious code in nightwatch-event-gammarayburst-eridanus (npm)
- Nov 13, 2025
Malicious code in nightwatch-despina-markdownlint-vuepress (npm)
- Nov 13, 2025
Malicious code in nightwatch-aldebaran-stratosphere-bionics (npm)
- Nov 13, 2025
Malicious code in nightwatch-abiogenesis-semantic-release-supercluster (npm)
- Nov 13, 2025
Malicious code in nightmare-version-levels-mui (npm)
- Nov 13, 2025
Malicious code in nightmare-start-meteor-node-sass (npm)
- Nov 13, 2025
Malicious code in nightmare-semantic-ui-init-config (npm)
- Nov 13, 2025
Malicious code in nightmare-package-quark-cli (npm)
- Nov 13, 2025
Malicious code in nightmare-mesosphere-iota-dotenv (npm)
- Nov 13, 2025
Malicious code in nightmare-jasmine-janus-prompts (npm)
- Nov 13, 2025
Malicious code in nightmare-europa-restart-antares (npm)
- Nov 13, 2025
Malicious code in nextjs-weywot-bioinformatics-selenium (npm)
Page 317 of 4,814