Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in ini-koa-adonis-astrometry (npm)
- Nov 13, 2025
Malicious code in ini-barnard-juno-shelljs (npm)
- Nov 13, 2025
Malicious code in info-user-wind-book-sanitize (npm)
- Nov 13, 2025
Malicious code in info-byte-simulate-cat-sudo (npm)
- Nov 13, 2025
Malicious code in inflation-weywot-comet-xo (npm)
- Nov 13, 2025
Malicious code in inflation-technocracy-css-minimizer-webpack-plugin-await (npm)
- Nov 13, 2025
Malicious code in inflation-hercules-websockets-private (npm)
- Nov 13, 2025
Malicious code in inflation-apollo-rocket-higgs (npm)
- Nov 13, 2025
Malicious code in inflation-antd-dependencies-phoenix (npm)
- Nov 13, 2025
Malicious code in indus-virgo-publish-taurus (npm)
- Nov 13, 2025
Malicious code in indus-triton-polaris-nextjs (npm)
- Nov 13, 2025
Malicious code in indus-reveal-md-gulp-neptune (npm)
- Nov 13, 2025
Malicious code in indus-neptune-typeorm-io (npm)
- Nov 13, 2025
Malicious code in indus-farout-carpo-astrobiology (npm)
- Nov 13, 2025
Malicious code in indus-cybernetics-prettier-plugin-markdown-pavo (npm)
- Nov 13, 2025
Malicious code in indus-coronalmassejection-sass-loader-virgo (npm)
- Nov 13, 2025
Malicious code in index-wind-info-emulate-fork (npm)
- Nov 13, 2025
Malicious code in index-short-java-phi-virtualize (npm)
- Nov 13, 2025
Malicious code in index-load-rain-gamma-log (npm)
- Nov 13, 2025
Malicious code in index-grid-unix-long-kappa (npm)
- Nov 13, 2025
Malicious code in index-gamma-authorize-deploy-async (npm)
- Nov 13, 2025
Malicious code in index-error-cold-earth-encode (npm)
- Nov 13, 2025
Malicious code in index-chi-grep-nu-wind (npm)
- Nov 13, 2025
Malicious code in impulse-toml-despina-bootes (npm)
- Nov 13, 2025
Malicious code in impulse-sedna-sedna-cryovolcano (npm)
- Nov 13, 2025
Malicious code in impulse-node-sass-private-vuetify (npm)
- Nov 13, 2025
Malicious code in impulse-holography-grunt-sequelize (npm)
- Nov 13, 2025
Malicious code in impulse-figures-inquirer-oortcloud (npm)
- Nov 13, 2025
Malicious code in impulse-eslint-config-zenobia-octans (npm)
- Nov 13, 2025
Malicious code in impulse-dependencies-spinner-figures (npm)
- Nov 13, 2025
Malicious code in impulse-blaze-yonder-eleventy (npm)
- Nov 13, 2025
Malicious code in import-uglify-shell-assert-key (npm)
- Nov 13, 2025
Malicious code in import-scale-deserialize-sudo-visualize (npm)
- Nov 13, 2025
Malicious code in import-proxy-cron-balance-abstract (npm)
- Nov 13, 2025
Malicious code in import-omega-long-cloud-gamma (npm)
- Nov 13, 2025
Malicious code in import-log-monitor-rho-function (npm)
- Nov 13, 2025
Malicious code in import-float-omega-user-eta (npm)
- Nov 13, 2025
Malicious code in import-debug-compress-byte-long (npm)
- Nov 13, 2025
Malicious code in import-compile-compile-bad-report (npm)
- Nov 13, 2025
Malicious code in import-benchmark-warn-node-catch (npm)
- Nov 13, 2025
Malicious code in import-abstract-nu-private-decrypt (npm)
- Nov 13, 2025
Malicious code in ignite-rehype-xo-cypress (npm)
- Nov 13, 2025
Malicious code in ignite-puppeteer-procyon-vortex (npm)
- Nov 13, 2025
Malicious code in ignite-jekyll-europa-galaxy (npm)
- Nov 13, 2025
Malicious code in ignite-hermes-ophiuchus-semantic-ui (npm)
- Nov 13, 2025
Malicious code in ignite-cosmicray-accretion-altair (npm)
- Nov 13, 2025
Malicious code in ignite-configstore-morgan-kastra (npm)
- Nov 13, 2025
Malicious code in ignite-chai-mira-neptune (npm)
- Nov 13, 2025
Malicious code in ignite-callback-cosmochemistry-paleobotany (npm)
- Nov 13, 2025
Malicious code in ichnology-ursa-petrology-cluster (npm)
Page 334 of 4,814