Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in library-alphard-nova-planetology (npm)
- Nov 13, 2025
Malicious code in levels-paleoecology-blackhole-abiogenesis (npm)
- Nov 13, 2025
Malicious code in levels-lacerta-entanglement-entanglement (npm)
- Nov 13, 2025
Malicious code in levels-jsonp-iota-abiogenesis (npm)
- Nov 13, 2025
Malicious code in levels-event-bionics-nodejs (npm)
- Nov 13, 2025
Malicious code in levels-eris-ora-hydra (npm)
- Nov 13, 2025
Malicious code in levels-convict-json-dynamo (npm)
- Nov 13, 2025
Malicious code in levels-await-postcss-comet (npm)
- Nov 13, 2025
Malicious code in less-radiometric-hydra-xml (npm)
- Nov 13, 2025
Malicious code in less-prettier-stylelint-warp-telesto (npm)
- Nov 13, 2025
Malicious code in less-pavo-restart-start (npm)
- Nov 13, 2025
Malicious code in less-mineralogy-airbnb-tardigrade (npm)
- Nov 13, 2025
Malicious code in less-loader-sedna-blaze-commitizen (npm)
- Nov 13, 2025
Malicious code in less-loader-rocket-adonis-kronos (npm)
- Nov 13, 2025
Malicious code in less-loader-react-bootstrap-cosmicray-spectroscopy (npm)
- Nov 13, 2025
Malicious code in less-loader-orbit-outercore-graphql (npm)
- Nov 13, 2025
Malicious code in less-loader-gulp-yaml-crust (npm)
- Nov 13, 2025
Malicious code in less-loader-grus-void-biosignature (npm)
- Nov 13, 2025
Malicious code in less-less-phenomic-paleoclimatology (npm)
- Nov 13, 2025
Malicious code in less-geckodriver-mongodb-nodejs (npm)
- Nov 13, 2025
Malicious code in less-eigenstate-eris-mineralogy (npm)
- Nov 13, 2025
Malicious code in less-cluster-soap-firebase (npm)
- Nov 13, 2025
Malicious code in less-bioinformatics-ganymede-virtualreality (npm)
- Nov 13, 2025
Malicious code in less-astrochemistry-ceres-halley (npm)
- Nov 13, 2025
Malicious code in less-antimatter-slides-phoebe (npm)
- Nov 13, 2025
Malicious code in lepton-xanthus-paleoanthropology-abiogenesis (npm)
- Nov 13, 2025
Malicious code in lepton-weywot-mira-pino-pretty (npm)
- Nov 13, 2025
Malicious code in lepton-sociobiology-duplex-nestjs (npm)
- Nov 13, 2025
Malicious code in lepton-pyxis-aldebaran-dotenv-parse-variables (npm)
- Nov 13, 2025
Malicious code in lepton-husky-phenomic-hermes (npm)
- Nov 13, 2025
Malicious code in lepton-cache-soap-hexo (npm)
- Nov 13, 2025
Malicious code in lepton-async-archaeogenetics-exoplanet (npm)
- Nov 13, 2025
Malicious code in leda-pm2-lacerta-speleology (npm)
- Nov 13, 2025
Malicious code in leda-pegasus-magnetosphere-sagitta (npm)
- Nov 13, 2025
Malicious code in leda-morgan-xanthus-ophiuchus (npm)
- Nov 13, 2025
Malicious code in leda-loopback-markdown-pdf-quasar (npm)
- Nov 13, 2025
Malicious code in leda-kaus-bellatrix-leda (npm)
- Nov 13, 2025
Malicious code in leda-jsonp-dependencies-eslint-config (npm)
- Nov 13, 2025
Malicious code in leda-hercules-restart-upgrade (npm)
- Nov 13, 2025
Malicious code in leda-gemini-saturnology-jovian (npm)
- Nov 13, 2025
Malicious code in leda-epigenetics-redshift-geochronology (npm)
- Nov 13, 2025
Malicious code in leda-electron-builder-chromedriver-nodemon (npm)
- Nov 13, 2025
Malicious code in leda-command-aquarius-leda (npm)
- Nov 13, 2025
Malicious code in leda-cassini-dactyl-mongodb (npm)
- Nov 13, 2025
Malicious code in lambda-transpile-gamma-omicron-resolve (npm)
- Nov 13, 2025
Malicious code in lambda-quick-monitor-optimize-book (npm)
- Nov 13, 2025
Malicious code in lambda-daemon-cron-delta-link (npm)
- Nov 13, 2025
Malicious code in lambda-cloud-class-public-meta (npm)
- Nov 13, 2025
Malicious code in lambda-byte-sigma-static-reject (npm)
- Nov 13, 2025
Malicious code in lacerta-style-loader-mini-css-extract-plugin-less (npm)
Page 328 of 4,814