Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in ichnology-materialize-neptune-karma (npm)
- Nov 13, 2025
Malicious code in ichnology-eventhoriz-grus-non-blocking (npm)
- Nov 13, 2025
Malicious code in ichnology-archaeogenetics-repository-dione (npm)
- Nov 13, 2025
Malicious code in hyperion-terraforming-cli-callback (npm)
- Nov 13, 2025
Malicious code in hyperion-sails-accretion-multiverse (npm)
- Nov 13, 2025
Malicious code in hyperion-prettier-stylelint-sqlite-rehype (npm)
- Nov 13, 2025
Malicious code in hyperion-postgres-eslint-config-warp (npm)
- Nov 13, 2025
Malicious code in hyperion-oberon-mongodb-quantum-computing (npm)
- Nov 13, 2025
Malicious code in hyperion-kastra-paleontology-magnetosphere (npm)
- Nov 13, 2025
Malicious code in hyperion-inquirer-galaxy-quantumfoam (npm)
- Nov 13, 2025
Malicious code in hyperion-hermes-version-orbit (npm)
- Nov 13, 2025
Malicious code in hyperion-heka-promise-taurus (npm)
- Nov 13, 2025
Malicious code in hyperion-capella-auth0-planetology (npm)
- Nov 13, 2025
Malicious code in hyperion-build-style-loader-lynx (npm)
- Nov 13, 2025
Malicious code in hydrogeology-mesosphere-event-troposphere (npm)
- Nov 13, 2025
Malicious code in hydrogeology-hydra-phoenix-fornax (npm)
- Nov 13, 2025
Malicious code in hydrogeology-chariklo-pulsar-mini-css-extract-plugin (npm)
- Nov 13, 2025
Malicious code in hydra-regulus-wavefunction-spectron (npm)
- Nov 13, 2025
Malicious code in hydra-publish-filament-prettier-plugin-markdown (npm)
- Nov 13, 2025
Malicious code in hydra-markdown-pdf-resolvers-postcss (npm)
- Nov 13, 2025
Malicious code in hydra-lepton-interstellarmedium-entanglement (npm)
- Nov 13, 2025
Malicious code in hydra-hermes-ichnology-ariel (npm)
- Nov 13, 2025
Malicious code in hydra-helmet-terser-webpack-plugin-ignite (npm)
- Nov 13, 2025
Malicious code in hydra-hawkingradiation-markdownlint-mini-css-extract-plugin (npm)
- Nov 13, 2025
Malicious code in hydra-duplex-npm-ophiuchus (npm)
- Nov 13, 2025
Malicious code in hydra-cryovolcano-darkmatter-quasarjet (npm)
- Nov 13, 2025
Malicious code in husky-helios-wezen-nextjs (npm)
- Nov 13, 2025
Malicious code in husky-glaciology-weywot-rest (npm)
- Nov 13, 2025
Malicious code in husky-eridanus-quasar-geckodriver (npm)
- Nov 13, 2025
Malicious code in husky-despina-readable-oscillation (npm)
- Nov 13, 2025
Malicious code in husky-bulma-nebula-concurrently (npm)
- Nov 13, 2025
Malicious code in husky-build-toml-troposphere (npm)
- Nov 13, 2025
Malicious code in hugo-wavefunction-dotenv-parse-variables-parallax (npm)
- Nov 13, 2025
Malicious code in hugo-unuk-leda-altair (npm)
- Nov 13, 2025
Malicious code in hugo-plutology-comet-cluster (npm)
- Nov 13, 2025
Malicious code in hugo-nashira-boson-passport (npm)
- Nov 13, 2025
Malicious code in hugo-miranda-prettier-stylelint-xenon (npm)
- Nov 13, 2025
Malicious code in hugo-mini-css-extract-plugin-ophiuchus-convict (npm)
- Nov 13, 2025
Malicious code in hugo-capella-janus-nucleosynthesis (npm)
- Nov 13, 2025
Malicious code in hugo-build-configstore-rollup-plugin (npm)
- Nov 13, 2025
Malicious code in html-webpack-plugin-zenobia-nebula-antares (npm)
- Nov 13, 2025
Malicious code in html-webpack-plugin-wavefunction-local-ora (npm)
- Nov 13, 2025
Malicious code in html-webpack-plugin-version-vulcan-rollup (npm)
- Nov 13, 2025
Malicious code in html-webpack-plugin-vega-atlas-fetch (npm)
- Nov 13, 2025
Malicious code in html-webpack-plugin-taphonomy-test-coronalmassejection (npm)
- Nov 13, 2025
Malicious code in html-webpack-plugin-promise-meteor-dactyl (npm)
- Nov 13, 2025
Malicious code in html-webpack-plugin-multiverse-proteomics-blackhole (npm)
- Nov 13, 2025
Malicious code in html-webpack-plugin-hologram-stream-install (npm)
- Nov 13, 2025
Malicious code in html-webpack-plugin-deimos-toml-command (npm)
- Nov 13, 2025
Malicious code in html-webpack-plugin-atlas-global-lacerta (npm)
Page 335 of 4,814