Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,658 total in npm · sorted newest first- Nov 13, 2025
Malicious code in dagda-ophiuchus-koa-solarnebula (npm)
- Nov 13, 2025
Malicious code in dagda-non-blocking-html-webpack-plugin-astrophysics (npm)
- Nov 13, 2025
Malicious code in dagda-geckodriver-perturbation-geodynamo (npm)
- Nov 13, 2025
Malicious code in dagda-ganymede-fornax-ursa (npm)
- Nov 13, 2025
Malicious code in dagda-event-despina-event (npm)
- Nov 13, 2025
Malicious code in dagda-ablation-ganymede-meteor (npm)
- Nov 13, 2025
Malicious code in daemon-old-mu-interpret-deserialize (npm)
- Nov 13, 2025
Malicious code in daemon-function-throw-file-dog (npm)
- Nov 13, 2025
Malicious code in daemon-epsilon-hash-link-slow (npm)
- Nov 13, 2025
Malicious code in daemon-container-rain-route-reject (npm)
- Nov 13, 2025
Malicious code in dactyl-transform-nightwatch-petrology (npm)
- Nov 13, 2025
Malicious code in dactyl-phoenix-rest-gulp (npm)
- Nov 13, 2025
Malicious code in dactyl-loopback-axios-lacerta (npm)
- Nov 13, 2025
Malicious code in cz-conventional-changelog-webdriver-mocha-lepton-abiogenesis (npm)
- Nov 13, 2025
Malicious code in cz-conventional-changelog-stop-readable-mutation (npm)
- Nov 13, 2025
Malicious code in cz-conventional-changelog-sirius-cluster-tectonophysics (npm)
- Nov 13, 2025
Malicious code in cz-conventional-changelog-selenium-xanadu-enif (npm)
- Nov 13, 2025
Malicious code in cz-conventional-changelog-ora-rehype-xanadu (npm)
- Nov 13, 2025
Malicious code in cz-conventional-changelog-heliophysics-carpo-mocha (npm)
- Nov 13, 2025
Malicious code in cz-conventional-changelog-blitz-steganography-lacerta (npm)
- Nov 13, 2025
Malicious code in cypress-vuetify-mutation-hermes (npm)
- Nov 13, 2025
Malicious code in cypress-technosignature-solarnebula-protractor (npm)
- Nov 13, 2025
Malicious code in cypress-procyon-neptune-epigenetics (npm)
- Nov 13, 2025
Malicious code in cypress-phoenix-higgs-chromedriver (npm)
- Nov 13, 2025
Malicious code in cypress-geckodriver-vulcan-metalsmith (npm)
- Nov 13, 2025
Malicious code in cypress-enif-robotics-miranda (npm)
- Nov 13, 2025
Malicious code in cypress-cosmiconfig-dotenv-safe-telesto (npm)
- Nov 13, 2025
Malicious code in cygnus-winston-geodynamo-biomimicry (npm)
- Nov 13, 2025
Malicious code in cygnus-whitedwarf-entanglement-google (npm)
- Nov 13, 2025
Malicious code in cygnus-umbra-webdriver-mocha-docusaurus (npm)
- Nov 13, 2025
Malicious code in cygnus-tool-update-xenos (npm)
- Nov 13, 2025
Malicious code in cygnus-got-nconf-public (npm)
- Nov 13, 2025
Malicious code in cybernetics-uninstall-kinetic-neptune (npm)
- Nov 13, 2025
Malicious code in cybernetics-selenology-local-eridanus (npm)
- Nov 13, 2025
Malicious code in cybernetics-duplex-wolf-json (npm)
- Nov 13, 2025
Malicious code in cybernetics-duplex-oscillation-publish (npm)
- Nov 13, 2025
Malicious code in cybernetics-configstore-apex-luna (npm)
- Nov 13, 2025
Malicious code in cybernetics-concurrently-testcafe-foundation (npm)
- Nov 13, 2025
Malicious code in csv-steganography-sadr-buffer (npm)
- Nov 13, 2025
Malicious code in csv-puppeteer-phoenix-event (npm)
- Nov 13, 2025
Malicious code in csv-mongodb-rehype-less-loader (npm)
- Nov 13, 2025
Malicious code in csv-mensa-hadron-sagitta (npm)
- Nov 13, 2025
Malicious code in csv-helmet-dione-canopus (npm)
- Nov 13, 2025
Malicious code in csv-envconfig-achernar-stratigraphy (npm)
- Nov 13, 2025
Malicious code in csv-dysonswarm-aether-optimize-css-assets-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in csv-aldebaran-biohacking-cluster (npm)
- Nov 13, 2025
Malicious code in css-minimizer-webpack-plugin-vuetify-ichnology-redshift (npm)
- Nov 13, 2025
Malicious code in css-minimizer-webpack-plugin-virtualreality-ignite-node-sass (npm)
- Nov 13, 2025
Malicious code in css-minimizer-webpack-plugin-superagent-npm-private (npm)
- Nov 13, 2025
Malicious code in css-minimizer-webpack-plugin-phoebe-biogeochemistry-lint (npm)
Page 354 of 4,814