Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in moon-omicron-stub-long-book (npm)
- Nov 13, 2025
Malicious code in moon-old-gamma-deploy-cloud (npm)
- Nov 13, 2025
Malicious code in moon-new-cloud-mu-cat (npm)
- Nov 13, 2025
Malicious code in monitor-data-uglify-compress-book (npm)
- Nov 13, 2025
Malicious code in mongoose-wolf-deimos-forever (npm)
- Nov 13, 2025
Malicious code in mongoose-supernova-transhumanism-gulp (npm)
- Nov 13, 2025
Malicious code in mongoose-odin-rimraf-petrology (npm)
- Nov 13, 2025
Malicious code in mongoose-electron-bunyan-event (npm)
- Nov 13, 2025
Malicious code in mongoose-docusaurus-fomalhaut-oauth (npm)
- Nov 13, 2025
Malicious code in mongoose-css-minimizer-webpack-plugin-spectroscopy-aquarius (npm)
- Nov 13, 2025
Malicious code in mongoose-cordelia-hawkingradiation-antares (npm)
- Nov 13, 2025
Malicious code in mongoose-convict-kaus-thermochronology (npm)
- Nov 13, 2025
Malicious code in mongodb-nodemon-callback-areology (npm)
- Nov 13, 2025
Malicious code in mongodb-kastra-gridsome-fusion (npm)
- Nov 13, 2025
Malicious code in mongodb-cz-conventional-changelog-rollup-plugin-biosignature (npm)
- Nov 13, 2025
Malicious code in mongodb-augmentedreality-mineralogy-postcss (npm)
- Nov 13, 2025
Malicious code in module-void-fast-thread-double (npm)
- Nov 13, 2025
Malicious code in module-user-signal-pi-monitor (npm)
- Nov 13, 2025
Malicious code in module-serialize-fire-bash-mu (npm)
- Nov 13, 2025
Malicious code in module-phoebe-elara-meissa (npm)
- Nov 13, 2025
Malicious code in module-palynology-kronos-fornax (npm)
- Nov 13, 2025
Malicious code in module-fornax-elara-mongodb (npm)
- Nov 13, 2025
Malicious code in module-data-secure-psi-double (npm)
- Nov 13, 2025
Malicious code in module-biomimicry-rollup-comet (npm)
- Nov 13, 2025
Malicious code in module-barnard-ganymede-sociobiology (npm)
- Nov 13, 2025
Malicious code in module-aquarius-enceladus-publish (npm)
- Nov 13, 2025
Malicious code in mock-xml-omicron-protected-class (npm)
- Nov 13, 2025
Malicious code in mock-string-simple-final-data (npm)
- Nov 13, 2025
Malicious code in mock-sandbox-private-stub-view (npm)
- Nov 13, 2025
Malicious code in mock-parse-earth-export-hot (npm)
- Nov 13, 2025
Malicious code in mock-easy-tree-long-cloud (npm)
- Nov 13, 2025
Malicious code in mocha-solis-zenobia-norma (npm)
- Nov 13, 2025
Malicious code in mocha-neptunology-flare-galaxy (npm)
- Nov 13, 2025
Malicious code in mocha-eventhoriz-wavefunction-redshift (npm)
- Nov 13, 2025
Malicious code in mocha-epimetheus-zenith-commitlint-config-angular (npm)
- Nov 13, 2025
Malicious code in miranda-yildun-zooarchaeology-bionics (npm)
- Nov 13, 2025
Malicious code in miranda-stream-resolvers-convict (npm)
- Nov 13, 2025
Malicious code in miranda-spica-sails-superposition (npm)
- Nov 13, 2025
Malicious code in miranda-postcss-blitz-module (npm)
- Nov 13, 2025
Malicious code in miranda-perseus-pm2-ophiuchus (npm)
- Nov 13, 2025
Malicious code in miranda-nestjs-void-juno (npm)
- Nov 13, 2025
Malicious code in miranda-native-cross-env-oauth (npm)
- Nov 13, 2025
Malicious code in miranda-native-alphard-browserify (npm)
- Nov 13, 2025
Malicious code in miranda-markdown-pdf-rate-limiter-graphql (npm)
- Nov 13, 2025
Malicious code in miranda-lithosphere-xo-alphard (npm)
- Nov 13, 2025
Malicious code in miranda-leda-polaris-umbriel (npm)
- Nov 13, 2025
Malicious code in miranda-koa-fetch-duplex (npm)
- Nov 13, 2025
Malicious code in miranda-janus-fornax-eris (npm)
- Nov 13, 2025
Malicious code in miranda-genomics-uninstall-virgo (npm)
- Nov 13, 2025
Malicious code in miranda-gacrux-stratigraphy-node-sass (npm)
Page 321 of 4,814