Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in io-gulp-apollo-javascript (npm)
- Nov 13, 2025
Malicious code in io-cordelia-meteor-filament (npm)
- Nov 13, 2025
Malicious code in interstellarmedium-uninstall-update-paleoanthropology (npm)
- Nov 13, 2025
Malicious code in interstellarmedium-remark-procyon-dotenv-safe (npm)
- Nov 13, 2025
Malicious code in interstellarmedium-pino-bulma-darkenergy (npm)
- Nov 13, 2025
Malicious code in interstellarmedium-nightwatch-bionics-xanadu (npm)
- Nov 13, 2025
Malicious code in interstellarmedium-materialize-robotics-jovian (npm)
- Nov 13, 2025
Malicious code in interstellarmedium-coronalmassejection-hadron-quasar (npm)
- Nov 13, 2025
Malicious code in interpret-deploy-omega-async-fire (npm)
- Nov 13, 2025
Malicious code in interferometry-zephyr-procyon-wavefunction (npm)
- Nov 13, 2025
Malicious code in interferometry-paleoanthropology-innercore-seismology (npm)
- Nov 13, 2025
Malicious code in interface-stack-mock-execute-log (npm)
- Nov 13, 2025
Malicious code in interface-iota-tau-optimize-bundle (npm)
- Nov 13, 2025
Malicious code in interface-awk-balance-epsilon-orchestrate (npm)
- Nov 13, 2025
Malicious code in integer-web-key-resolve-mu (npm)
- Nov 13, 2025
Malicious code in integer-tau-chi-alert-gamma (npm)
- Nov 13, 2025
Malicious code in integer-slow-java-object-string (npm)
- Nov 13, 2025
Malicious code in integer-simulate-mu-class-permission (npm)
- Nov 13, 2025
Malicious code in integer-pipe-beta-orchestrate-simulate (npm)
- Nov 13, 2025
Malicious code in integer-optimize-alpha-byte-authenticate (npm)
- Nov 13, 2025
Malicious code in integer-omega-virtualize-star-meta (npm)
- Nov 13, 2025
Malicious code in integer-lambda-notify-cache-try (npm)
- Nov 13, 2025
Malicious code in integer-kappa-sigma-double-view (npm)
- Nov 13, 2025
Malicious code in install-geckodriver-blueshift-native (npm)
- Nov 13, 2025
Malicious code in install-fork-mdx-websockets (npm)
- Nov 13, 2025
Malicious code in install-enif-blitz-supervisor (npm)
- Nov 13, 2025
Malicious code in install-enceladus-mesosphere-superflare (npm)
- Nov 13, 2025
Malicious code in install-bunyan-bellatrix-impulse (npm)
- Nov 13, 2025
Malicious code in inquirer-winston-commitlint-cosmiconfig (npm)
- Nov 13, 2025
Malicious code in inquirer-technosignature-slidev-sagitta (npm)
- Nov 13, 2025
Malicious code in inquirer-stream-metabolomics-uninstall (npm)
- Nov 13, 2025
Malicious code in inquirer-resonance-stratosphere-zenobia (npm)
- Nov 13, 2025
Malicious code in inquirer-quasar-polaris-aquarius (npm)
- Nov 13, 2025
Malicious code in inquirer-loop-airbnb-proxima (npm)
- Nov 13, 2025
Malicious code in inquirer-flare-sass-loader-tectonic (npm)
- Nov 13, 2025
Malicious code in innercore-yildun-blaze-robotics (npm)
- Nov 13, 2025
Malicious code in innercore-superposition-lint-staged-adonis (npm)
- Nov 13, 2025
Malicious code in innercore-magnetar-xerxes-galaxy (npm)
- Nov 13, 2025
Malicious code in innercore-biohacking-aether-inflation (npm)
- Nov 13, 2025
Malicious code in innercore-alphard-eslint-config-xerxes (npm)
- Nov 13, 2025
Malicious code in init-venus-sync-figures (npm)
- Nov 13, 2025
Malicious code in init-rest-sedna-gacrux (npm)
- Nov 13, 2025
Malicious code in init-publish-boson-apex (npm)
- Nov 13, 2025
Malicious code in init-parcel-run-script-hugo (npm)
- Nov 13, 2025
Malicious code in init-optimize-css-assets-webpack-plugin-nodejs-grus (npm)
- Nov 13, 2025
Malicious code in init-mui-exobiology-local (npm)
- Nov 13, 2025
Malicious code in init-enceladus-quark-terraforming (npm)
- Nov 13, 2025
Malicious code in init-charon-terser-upgrade (npm)
- Nov 13, 2025
Malicious code in ini-quito-stratosphere-slides (npm)
- Nov 13, 2025
Malicious code in ini-mongodb-got-socketio (npm)
Page 333 of 4,814