Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,657 total in npm · sorted newest first- Nov 13, 2025
Malicious code in glaciology-kinetic-paleoclimatology-helmet (npm)
- Nov 13, 2025
Malicious code in geomorphology-materialize-perturbation-accretion (npm)
- Nov 13, 2025
Malicious code in geomorphology-fermion-aquarius-oscillation (npm)
- Nov 13, 2025
Malicious code in geomorphology-cressida-sync-atlas (npm)
- Nov 13, 2025
Malicious code in geomorphology-astrochemistry-alphard-zenith (npm)
- Nov 13, 2025
Malicious code in geodynamo-ursa-coronalmassejection-elara (npm)
- Nov 13, 2025
Malicious code in geodynamo-stop-hexo-markdown-pdf (npm)
- Nov 13, 2025
Malicious code in geodynamo-radiant-slides-bioinformatics (npm)
- Nov 13, 2025
Malicious code in geodynamo-hydrogeology-ultra-norma (npm)
- Nov 13, 2025
Malicious code in geodynamo-draco-cache-thermochronology (npm)
- Nov 13, 2025
Malicious code in geodynamo-callback-less-eclipse (npm)
- Nov 13, 2025
Malicious code in geodynamo-biosignature-crust-mongodb (npm)
- Nov 13, 2025
Malicious code in geochemistry-jsonp-virtualreality-primatology (npm)
- Nov 13, 2025
Malicious code in geochemistry-izar-farout-uninstall (npm)
- Nov 13, 2025
Malicious code in geoarchaeology-superagent-entanglement-semantic-ui (npm)
- Nov 13, 2025
Malicious code in geoarchaeology-sagitta-chalk-husky (npm)
- Nov 13, 2025
Malicious code in geoarchaeology-ora-titan-restart (npm)
- Nov 13, 2025
Malicious code in geoarchaeology-oberon-proteomics-xenon (npm)
- Nov 13, 2025
Malicious code in geoarchaeology-hologram-xerxes-void (npm)
- Nov 13, 2025
Malicious code in geoarchaeology-ethology-command-envconfig (npm)
- Nov 13, 2025
Malicious code in geoarchaeology-archaeogenetics-spectron-webdriver-chromedriver (npm)
- Nov 13, 2025
Malicious code in genomics-upgrade-webpack-bellatrix (npm)
- Nov 13, 2025
Malicious code in genomics-run-script-auth-neptune (npm)
- Nov 13, 2025
Malicious code in genomics-paleoclimatology-aldebaran-gacrux (npm)
- Nov 13, 2025
Malicious code in genomics-outercore-mongoose-csv (npm)
- Nov 13, 2025
Malicious code in genomics-lightyear-mesosphere-wolf (npm)
- Nov 13, 2025
Malicious code in genomics-biohacking-xanadu-cross-env (npm)
- Nov 13, 2025
Malicious code in gemini-sagitta-cordelia-aether (npm)
- Nov 13, 2025
Malicious code in gemini-query-adonis-request (npm)
- Nov 13, 2025
Malicious code in gemini-postgres-rehype-sagitta (npm)
- Nov 13, 2025
Malicious code in gemini-joviology-sedimentology-buffer (npm)
- Nov 13, 2025
Malicious code in gemini-ionosphere-superposition-package (npm)
- Nov 13, 2025
Malicious code in gemini-hydrogeology-panspermia-standard (npm)
- Nov 13, 2025
Malicious code in gemini-hercules-orbit-convict (npm)
- Nov 13, 2025
Malicious code in gemini-gravity-xanadu-css-minimizer-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in gemini-fornax-commitlint-rest (npm)
- Nov 13, 2025
Malicious code in gemini-dactyl-archaeogenetics-morgan (npm)
- Nov 13, 2025
Malicious code in gemini-csv-gacrux-andromeda (npm)
- Nov 13, 2025
Malicious code in gemini-csv-cryonics-castor (npm)
- Nov 13, 2025
Malicious code in geckodriver-slidev-protractor-hermes (npm)
- Nov 13, 2025
Malicious code in geckodriver-singularity-radiometric-xo (npm)
- Nov 13, 2025
Malicious code in geckodriver-sedna-private-colors (npm)
- Nov 13, 2025
Malicious code in geckodriver-public-paleobotany-telesto (npm)
- Nov 13, 2025
Malicious code in geckodriver-nebula-spawn-apollo (npm)
- Nov 13, 2025
Malicious code in geckodriver-configstore-wasat-sirius (npm)
- Nov 13, 2025
Malicious code in geckodriver-betelgeuse-uninstall-csrf (npm)
- Nov 13, 2025
Malicious code in gatsby-upgrade-aldebaran-antares (npm)
- Nov 13, 2025
Malicious code in gatsby-tardigrade-hyperion-got (npm)
- Nov 13, 2025
Malicious code in gatsby-interstellarmedium-vuetify-procyon (npm)
- Nov 13, 2025
Malicious code in gatsby-fornax-nuxtjs-vuetify (npm)
Page 340 of 4,814