Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in loopback-tethys-airbnb-typeorm (npm)
- Nov 13, 2025
Malicious code in loopback-remark-cordelia-commitlint (npm)
- Nov 13, 2025
Malicious code in loopback-magellan-foundation-csrf (npm)
- Nov 13, 2025
Malicious code in loop-webdriverio-vulcan-proxima (npm)
- Nov 13, 2025
Malicious code in loop-wasat-chai-equinox (npm)
- Nov 13, 2025
Malicious code in loop-quito-hyperion-centauri (npm)
- Nov 13, 2025
Malicious code in loop-mysql-jwt-jekyll (npm)
- Nov 13, 2025
Malicious code in loop-cosmos-perturbation-andromeda (npm)
- Nov 13, 2025
Malicious code in loop-cosmicray-repository-entanglement (npm)
- Nov 13, 2025
Malicious code in long-zero-rain-daemon-refactor (npm)
- Nov 13, 2025
Malicious code in long-sigma-authenticate-alpha-analyze (npm)
- Nov 13, 2025
Malicious code in long-nu-new-nu-cache (npm)
- Nov 13, 2025
Malicious code in long-new-report-analyze-permission (npm)
- Nov 13, 2025
Malicious code in long-module-report-abstract-alpha (npm)
- Nov 13, 2025
Malicious code in long-final-minify-load-tree (npm)
- Nov 13, 2025
Malicious code in long-class-report-grep-catch (npm)
- Nov 13, 2025
Malicious code in long-boolean-table-compress-tree (npm)
- Nov 13, 2025
Malicious code in long-alpha-code-sun-table (npm)
- Nov 13, 2025
Malicious code in loglevel-testcafe-spectron-leda (npm)
- Nov 13, 2025
Malicious code in loglevel-selenium-process-mongoose (npm)
- Nov 13, 2025
Malicious code in loglevel-meteor-mui-version (npm)
- Nov 13, 2025
Malicious code in loglevel-hyperion-bootstrap-mysql (npm)
- Nov 13, 2025
Malicious code in loglevel-exobiology-eslint-config-rate-limiter (npm)
- Nov 13, 2025
Malicious code in loglevel-event-resonance-umbriel (npm)
- Nov 13, 2025
Malicious code in log-slow-debug-zero-report (npm)
- Nov 13, 2025
Malicious code in log-info-good-promise-user (npm)
- Nov 13, 2025
Malicious code in log-delta-daemon-finally-minify (npm)
- Nov 13, 2025
Malicious code in log-cron-execute-small-signal (npm)
- Nov 13, 2025
Malicious code in log-byte-cluster-uglify-error (npm)
- Nov 13, 2025
Malicious code in local-ursa-karma-mysql (npm)
- Nov 13, 2025
Malicious code in local-terser-postcss-loader-eventhoriz (npm)
- Nov 13, 2025
Malicious code in local-lyra-cli-rimraf (npm)
- Nov 13, 2025
Malicious code in local-kaus-wolf-local (npm)
- Nov 13, 2025
Malicious code in local-jasmine-gammarayburst-delphinus (npm)
- Nov 13, 2025
Malicious code in local-farout-transform-chai (npm)
- Nov 13, 2025
Malicious code in local-cz-conventional-changelog-cosmos-quark (npm)
- Nov 13, 2025
Malicious code in local-astrobiology-magellan-airbnb (npm)
- Nov 13, 2025
Malicious code in local-astro-inquirer-neptune (npm)
- Nov 13, 2025
Malicious code in local-ariel-elara-schema (npm)
- Nov 13, 2025
Malicious code in load-wind-root-balance-file (npm)
- Nov 13, 2025
Malicious code in load-protected-file-index-analyze (npm)
- Nov 13, 2025
Malicious code in load-integer-wind-byte-key (npm)
- Nov 13, 2025
Malicious code in load-float-omega-char-mock (npm)
- Nov 13, 2025
Malicious code in load-fire-balance-try-old (npm)
- Nov 13, 2025
Malicious code in load-abstract-final-static-pipe (npm)
- Nov 13, 2025
Malicious code in lithosphere-quark-mesosphere-cache (npm)
- Nov 13, 2025
Malicious code in lithosphere-pegasus-jest-paleoecology (npm)
- Nov 13, 2025
Malicious code in lithosphere-markdown-pdf-winston-neptune (npm)
- Nov 13, 2025
Malicious code in lithosphere-inflation-antimatter-europa (npm)
- Nov 13, 2025
Malicious code in lithosphere-geodynamo-mui-robotics (npm)
Page 326 of 4,814