Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in lacerta-polaris-tool-resolvers (npm)
- Nov 13, 2025
Malicious code in lacerta-paleobotany-convict-babel (npm)
- Nov 13, 2025
Malicious code in lacerta-chalk-ini-neptune (npm)
- Nov 13, 2025
Malicious code in lacerta-ceres-jwt-stream (npm)
- Nov 13, 2025
Malicious code in lacerta-blackhole-juno-capella (npm)
- Nov 13, 2025
Malicious code in lacerta-betelgeuse-xanthus-upgrade (npm)
- Nov 13, 2025
Malicious code in lacerta-auth0-callisto-dorado (npm)
- Nov 13, 2025
Malicious code in kuiperbelt-yakutsk-bioinformatics-express (npm)
- Nov 13, 2025
Malicious code in kuiperbelt-taurus-csv-ceres (npm)
- Nov 13, 2025
Malicious code in kuiperbelt-protractor-epigenetics-kardashevscale (npm)
- Nov 13, 2025
Malicious code in kuiperbelt-phoebe-native-abiogenesis (npm)
- Nov 13, 2025
Malicious code in kuiperbelt-nova-parsec-helios (npm)
- Nov 13, 2025
Malicious code in kronos-pipe-delphinus-centauri (npm)
- Nov 13, 2025
Malicious code in kronos-phoebe-kronos-elektra (npm)
- Nov 13, 2025
Malicious code in kronos-lynx-brane-venus (npm)
- Nov 13, 2025
Malicious code in kronos-inquirer-promise-dactyl (npm)
- Nov 13, 2025
Malicious code in kronos-ichnology-dotenv-safe-seismology (npm)
- Nov 13, 2025
Malicious code in kronos-buffer-titan-zephyr (npm)
- Nov 13, 2025
Malicious code in koa-version-scorpius-ceres (npm)
- Nov 13, 2025
Malicious code in koa-vega-zenith-canopus (npm)
- Nov 13, 2025
Malicious code in koa-prettier-stylelint-link-google (npm)
- Nov 13, 2025
Malicious code in koa-higgs-jasmine-wezen (npm)
- Nov 13, 2025
Malicious code in koa-eslint-plugin-corvus-dotenv-parse-variables (npm)
- Nov 13, 2025
Malicious code in koa-callback-postcss-loader-webdriver-manager (npm)
- Nov 13, 2025
Malicious code in koa-betelgeuse-luna-cassini (npm)
- Nov 13, 2025
Malicious code in kinetic-upgrade-pino-sagitta (npm)
- Nov 13, 2025
Malicious code in kinetic-redshift-pino-pretty-prettier-plugin-markdown (npm)
- Nov 13, 2025
Malicious code in kinetic-paleoclimatology-holography-tailwindcss (npm)
- Nov 13, 2025
Malicious code in kinetic-ora-bootstrap-redshift (npm)
- Nov 13, 2025
Malicious code in kinetic-module-apollo-pm2 (npm)
- Nov 13, 2025
Malicious code in kinetic-jovian-auth-cache (npm)
- Nov 13, 2025
Malicious code in kinetic-iota-lint-palynology (npm)
- Nov 13, 2025
Malicious code in kinetic-configstore-nuxtjs-colors (npm)
- Nov 13, 2025
Malicious code in kinetic-backend-technocracy-archaeometry (npm)
- Nov 13, 2025
Malicious code in key-tree-cron-serialize-process (npm)
- Nov 13, 2025
Malicious code in key-static-authorize-authenticate-quick (npm)
- Nov 13, 2025
Malicious code in key-refactor-finally-optimize-pipe (npm)
- Nov 13, 2025
Malicious code in key-orchestrate-promise-mu-bad (npm)
- Nov 13, 2025
Malicious code in key-notify-stack-water-module (npm)
- Nov 13, 2025
Malicious code in key-kernel-transpile-test-yaml (npm)
- Nov 13, 2025
Malicious code in key-encrypt-bad-class-kernel (npm)
- Nov 13, 2025
Malicious code in key-class-optimize-notify-fire (npm)
- Nov 13, 2025
Malicious code in kernel-visualize-meta-import-transpile (npm)
- Nov 13, 2025
Malicious code in kernel-stack-grep-zero-table (npm)
- Nov 13, 2025
Malicious code in kernel-promise-proxy-xml-pipe (npm)
- Nov 13, 2025
Malicious code in kernel-encode-benchmark-interface-virtualize (npm)
- Nov 13, 2025
Malicious code in kaus-triton-sadr-aurora (npm)
- Nov 13, 2025
Malicious code in kaus-atlas-aurora-promise (npm)
- Nov 13, 2025
Malicious code in kaus-antares-update-neptune (npm)
- Nov 13, 2025
Malicious code in kastra-perseus-comet-deimos (npm)
Page 329 of 4,814