Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in nashira-dotenv-parse-variables-gulp-lynx (npm)
- Nov 13, 2025
Malicious code in nashira-betelgeuse-astrometry-callback (npm)
- Nov 13, 2025
Malicious code in nanotechnology-seismology-dotenv-parse-variables-darkenergy (npm)
- Nov 13, 2025
Malicious code in nanotechnology-nightwatch-elara-mira (npm)
- Nov 13, 2025
Malicious code in nanotechnology-eventhoriz-iota-commitizen (npm)
- Nov 13, 2025
Malicious code in nanotechnology-ariel-atlas-loopback (npm)
- Nov 13, 2025
Malicious code in mysql-spectron-webdriver-primatology-eslint-plugin (npm)
- Nov 13, 2025
Malicious code in mysql-quasar-nodejs-node-sass (npm)
- Nov 13, 2025
Malicious code in mysql-local-bootes-triton (npm)
- Nov 13, 2025
Malicious code in mysql-joviology-eslint-config-exoplanetology (npm)
- Nov 13, 2025
Malicious code in mysql-heka-version-saturnology (npm)
- Nov 13, 2025
Malicious code in mysql-fork-pavo-firebase (npm)
- Nov 13, 2025
Malicious code in mysql-enceladus-cressida-whitedwarf (npm)
- Nov 13, 2025
Malicious code in mysql-cassini-unuk-middleware (npm)
- Nov 13, 2025
Malicious code in mutation-telesto-cybernetics-library (npm)
- Nov 13, 2025
Malicious code in mutation-promise-xenon-fermion (npm)
- Nov 13, 2025
Malicious code in mutation-local-archaeoastronomy-auth (npm)
- Nov 13, 2025
Malicious code in mutation-exec-arcturus-gulp (npm)
- Nov 13, 2025
Malicious code in mutation-dotenv-leda-crust (npm)
- Nov 13, 2025
Malicious code in mutation-docusaurus-scorpius-centauri (npm)
- Nov 13, 2025
Malicious code in mutation-cladistics-graviton-upgrade (npm)
- Nov 13, 2025
Malicious code in mutation-augmentedreality-archaeoastronomy-neutronstar (npm)
- Nov 13, 2025
Malicious code in multiverse-terser-webpack-plugin-vulcan-redgiant (npm)
- Nov 13, 2025
Malicious code in multiverse-perseus-ignite-ceres (npm)
- Nov 13, 2025
Malicious code in multiverse-pavo-dependencies-enif (npm)
- Nov 13, 2025
Malicious code in multiverse-jsonp-mdx-commitlint-config-angular (npm)
- Nov 13, 2025
Malicious code in multiverse-carina-boson-fusion (npm)
- Nov 13, 2025
Malicious code in mui-xerxes-proxima-cassini (npm)
- Nov 13, 2025
Malicious code in mui-reveal-md-registry-yaml (npm)
- Nov 13, 2025
Malicious code in mui-norma-callisto-terser-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in mui-neutrino-nestjs-stratigraphy (npm)
- Nov 13, 2025
Malicious code in mui-meissa-technosignature-wasat (npm)
- Nov 13, 2025
Malicious code in mui-meissa-subscription-event (npm)
- Nov 13, 2025
Malicious code in mui-delphinus-castor-magnetosphere (npm)
- Nov 13, 2025
Malicious code in mui-cluster-antares-nucleosynthesis (npm)
- Nov 13, 2025
Malicious code in mui-auth-betelgeuse-xo (npm)
- Nov 13, 2025
Malicious code in mui-asthenosphere-callback-webdriver-manager (npm)
- Nov 13, 2025
Malicious code in mu-slow-star-promise-eta (npm)
- Nov 13, 2025
Malicious code in mu-mu-psi-zero-java (npm)
- Nov 13, 2025
Malicious code in mu-kernel-phi-transpile-node (npm)
- Nov 13, 2025
Malicious code in mu-dog-proxy-decode-unix (npm)
- Nov 13, 2025
Malicious code in morgan-spectron-webdriver-primatology-aldebaran (npm)
- Nov 13, 2025
Malicious code in morgan-sass-loader-release-it-quark (npm)
- Nov 13, 2025
Malicious code in morgan-readable-auriga-promise (npm)
- Nov 13, 2025
Malicious code in morgan-react-bootstrap-cz-conventional-changelog-helios (npm)
- Nov 13, 2025
Malicious code in morgan-planckscale-rollup-plugin-void (npm)
- Nov 13, 2025
Malicious code in morgan-meteor-loop-delphinus (npm)
- Nov 13, 2025
Malicious code in morgan-magellan-public-envconfig (npm)
- Nov 13, 2025
Malicious code in moon-unix-meta-process-kernel (npm)
- Nov 13, 2025
Malicious code in moon-small-nu-rain-static (npm)
Page 320 of 4,814