Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,658 total in npm · sorted newest first- Nov 13, 2025
Malicious code in css-minimizer-webpack-plugin-hugo-gemini-command (npm)
- Nov 13, 2025
Malicious code in css-minimizer-webpack-plugin-hermes-spectron-pavo (npm)
- Nov 13, 2025
Malicious code in css-minimizer-webpack-plugin-framework-nextjs-upgrade (npm)
- Nov 13, 2025
Malicious code in css-minimizer-webpack-plugin-firebase-corvus-supernova (npm)
- Nov 13, 2025
Malicious code in css-minimizer-webpack-plugin-brane-saturnology-quito (npm)
- Nov 13, 2025
Malicious code in css-loader-rehype-toml-version (npm)
- Nov 13, 2025
Malicious code in css-loader-mui-wasat-standard (npm)
- Nov 13, 2025
Malicious code in css-loader-iota-celeste-electron (npm)
- Nov 13, 2025
Malicious code in css-loader-castor-supervisor-elara (npm)
- Nov 13, 2025
Malicious code in csrf-thermochronology-oscillation-janus (npm)
- Nov 13, 2025
Malicious code in csrf-relay-miranda-halley (npm)
- Nov 13, 2025
Malicious code in csrf-mutation-oauth-convict (npm)
- Nov 13, 2025
Malicious code in csrf-farout-backend-fomalhaut (npm)
- Nov 13, 2025
Malicious code in csrf-eslint-config-futurology-sass-loader (npm)
- Nov 13, 2025
Malicious code in csrf-carina-technocracy-areology (npm)
- Nov 13, 2025
Malicious code in csrf-callisto-hapi-nextjs (npm)
- Nov 13, 2025
Malicious code in csrf-bootes-html-webpack-plugin-ichnology (npm)
- Nov 13, 2025
Malicious code in cryptography-webdriver-manager-schema-test (npm)
- Nov 13, 2025
Malicious code in cryptography-epimetheus-prettier-plugin-markdown-run-script (npm)
- Nov 13, 2025
Malicious code in cryptography-cross-env-google-yildun (npm)
- Nov 13, 2025
Malicious code in cryptography-biohacking-xml-graphql (npm)
- Nov 13, 2025
Malicious code in cryovolcano-transhumanism-scripts-janus (npm)
- Nov 13, 2025
Malicious code in cryovolcano-miranda-blueshift-rimraf (npm)
- Nov 13, 2025
Malicious code in cryovolcano-grus-ini-proxima (npm)
- Nov 13, 2025
Malicious code in cryonics-publish-dactyl-pyxis (npm)
- Nov 13, 2025
Malicious code in cryonics-neutronstar-webdriver-mocha-whitedwarf (npm)
- Nov 13, 2025
Malicious code in cryonics-meteor-spawn-halley (npm)
- Nov 13, 2025
Malicious code in cryonics-magellan-bionics-tardigrade (npm)
- Nov 13, 2025
Malicious code in cryonics-jest-tachyon-hydra (npm)
- Nov 13, 2025
Malicious code in cryonics-cypress-stream-lithosphere (npm)
- Nov 13, 2025
Malicious code in cryonics-convict-tectonophysics-interstellarmedium (npm)
- Nov 13, 2025
Malicious code in cryonics-blazar-nightwatch-inflation (npm)
- Nov 13, 2025
Malicious code in crust-thuban-archaeogenetics-callback (npm)
- Nov 13, 2025
Malicious code in crust-proxima-typeorm-duplex (npm)
- Nov 13, 2025
Malicious code in crust-mui-development-norma (npm)
- Nov 13, 2025
Malicious code in cross-env-vega-native-blazar (npm)
- Nov 13, 2025
Malicious code in cross-env-singularity-europa-paleobotany (npm)
- Nov 13, 2025
Malicious code in cross-env-package-rimraf-antares (npm)
- Nov 13, 2025
Malicious code in cross-env-native-centaurus-dynamo (npm)
- Nov 13, 2025
Malicious code in cross-env-geochemistry-global-juno (npm)
- Nov 13, 2025
Malicious code in cross-env-flare-hyperion-meissa (npm)
- Nov 13, 2025
Malicious code in cross-env-dorado-eslint-config-zephyr (npm)
- Nov 13, 2025
Malicious code in cross-env-cybernetics-juno-iota (npm)
- Nov 13, 2025
Malicious code in cross-env-cross-env-photon-superposition (npm)
- Nov 13, 2025
Malicious code in cross-env-atlas-thuban-enif (npm)
- Nov 13, 2025
Malicious code in cross-env-atlas-non-blocking-eslint (npm)
- Nov 13, 2025
Malicious code in cron-tree-query-unix-report (npm)
- Nov 13, 2025
Malicious code in cron-rho-analyze-socket-air (npm)
- Nov 13, 2025
Malicious code in cron-optimize-thread-cat-compile (npm)
- Nov 13, 2025
Malicious code in cron-kappa-bash-serialize-beta (npm)
Page 355 of 4,814