Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,658 total in npm · sorted newest first- Nov 13, 2025
Malicious code in dotenv-safe-nodemon-ariel-petrology (npm)
- Nov 13, 2025
Malicious code in dotenv-safe-jovian-astroinformatics-ablation (npm)
- Nov 13, 2025
Malicious code in dotenv-safe-electron-delphinus-dynamo (npm)
- Nov 13, 2025
Malicious code in dotenv-parse-variables-public-cosmiconfig-zenobia (npm)
- Nov 13, 2025
Malicious code in dotenv-parse-variables-init-child-process-genomics (npm)
- Nov 13, 2025
Malicious code in dotenv-parse-variables-heliophysics-wasat-metalsmith (npm)
- Nov 13, 2025
Malicious code in dotenv-parse-variables-biogeochemistry-version-betelgeuse (npm)
- Nov 13, 2025
Malicious code in dotenv-parse-variables-astrobiology-readable-magellan (npm)
- Nov 13, 2025
Malicious code in dotenv-ophiuchus-steganography-event (npm)
- Nov 13, 2025
Malicious code in dotenv-metalsmith-proxima-heliophysics (npm)
- Nov 13, 2025
Malicious code in dotenv-hexo-apollo-cryonics (npm)
- Nov 13, 2025
Malicious code in dorado-spectron-webdriver-spectron-cache (npm)
- Nov 13, 2025
Malicious code in dorado-slidev-hyperion-avior (npm)
- Nov 13, 2025
Malicious code in dorado-norma-sequelize-hydrogeology (npm)
- Nov 13, 2025
Malicious code in dorado-jest-gatsby-fornax (npm)
- Nov 13, 2025
Malicious code in dorado-hydrogeology-zooarchaeology-regulus (npm)
- Nov 13, 2025
Malicious code in dorado-hexo-sqlite-postcss-loader (npm)
- Nov 13, 2025
Malicious code in dorado-development-troposphere-futurology (npm)
- Nov 13, 2025
Malicious code in dog-water-double-sudo-export (npm)
- Nov 13, 2025
Malicious code in dog-process-file-file-moon (npm)
- Nov 13, 2025
Malicious code in dog-daemon-transpile-grid-bundle (npm)
- Nov 13, 2025
Malicious code in dog-book-protected-scale-grid (npm)
- Nov 13, 2025
Malicious code in docusaurus-xml-proxima-luna (npm)
- Nov 13, 2025
Malicious code in docusaurus-titan-betelgeuse-request (npm)
- Nov 13, 2025
Malicious code in docusaurus-thermosphere-aquarius-rehype (npm)
- Nov 13, 2025
Malicious code in docusaurus-robotics-supercluster-sublimation (npm)
- Nov 13, 2025
Malicious code in docusaurus-mdx-ionosphere-fermiparadox (npm)
- Nov 13, 2025
Malicious code in docusaurus-impulse-dagda-ignite (npm)
- Nov 13, 2025
Malicious code in docusaurus-hugo-uglify-js-dione (npm)
- Nov 13, 2025
Malicious code in docusaurus-eventhoriz-heliophysics-neutronstar (npm)
- Nov 13, 2025
Malicious code in docusaurus-callback-abiogenesis-mesosphere (npm)
- Nov 13, 2025
Malicious code in docusaurus-buffer-sequelize-cassini (npm)
- Nov 13, 2025
Malicious code in docusaurus-bellatrix-xanthus-virgo (npm)
- Nov 13, 2025
Malicious code in dione-troposphere-oscillation-andromeda (npm)
- Nov 13, 2025
Malicious code in dione-transport-astrobiology-leda (npm)
- Nov 13, 2025
Malicious code in dione-kastra-public-react-bootstrap (npm)
- Nov 13, 2025
Malicious code in dione-dorado-apollo-mongodb (npm)
- Nov 13, 2025
Malicious code in dione-cressida-schema-spectron (npm)
- Nov 13, 2025
Malicious code in development-xerxes-dagda-repository (npm)
- Nov 13, 2025
Malicious code in development-webdriver-mocha-leda-bellatrix (npm)
- Nov 13, 2025
Malicious code in development-warp-geoarchaeology-odin (npm)
- Nov 13, 2025
Malicious code in development-rollup-pipe-koa (npm)
- Nov 13, 2025
Malicious code in development-postcss-loader-webpack-cosmicweb (npm)
- Nov 13, 2025
Malicious code in development-playwright-stratosphere-parcel (npm)
- Nov 13, 2025
Malicious code in development-outercore-neptune-singularitarianism (npm)
- Nov 13, 2025
Malicious code in development-mineralogy-vortex-scripts (npm)
- Nov 13, 2025
Malicious code in development-kinetic-mocha-equinox (npm)
- Nov 13, 2025
Malicious code in development-dependencies-cybernetics-cryptography (npm)
- Nov 13, 2025
Malicious code in development-cypress-nebula-spectron (npm)
- Nov 13, 2025
Malicious code in development-child-process-npm-socketio (npm)
Page 351 of 4,814