Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,658 total in npm · sorted newest first- Nov 13, 2025
Malicious code in corvus-biohacking-helmet-pm2 (npm)
- Nov 13, 2025
Malicious code in cors-zenobia-dagda-lint (npm)
- Nov 13, 2025
Malicious code in cors-warp-farout-testcafe (npm)
- Nov 13, 2025
Malicious code in cors-standard-epimetheus-telesto (npm)
- Nov 13, 2025
Malicious code in cors-relay-mini-css-extract-plugin-winston (npm)
- Nov 13, 2025
Malicious code in cors-google-mocha-prettier (npm)
- Nov 13, 2025
Malicious code in cors-centaurus-electron-builder-galaxy (npm)
- Nov 13, 2025
Malicious code in coronalmassejection-terser-zooarchaeology-telesto (npm)
- Nov 13, 2025
Malicious code in coronalmassejection-sirius-morgan-process (npm)
- Nov 13, 2025
Malicious code in coronalmassejection-holography-dorado-command (npm)
- Nov 13, 2025
Malicious code in coronalmassejection-express-stream-cryonics (npm)
- Nov 13, 2025
Malicious code in coronalmassejection-asthenosphere-astrobiology-cassini (npm)
- Nov 13, 2025
Malicious code in cordelia-zenith-ganymede-mutation (npm)
- Nov 13, 2025
Malicious code in cordelia-websockets-yakutsk-quark (npm)
- Nov 13, 2025
Malicious code in cordelia-solis-markdown-xerxes (npm)
- Nov 13, 2025
Malicious code in cordelia-indus-cors-dotenv-safe (npm)
- Nov 13, 2025
Malicious code in cordelia-dione-hyperion-superposition (npm)
- Nov 13, 2025
Malicious code in cordelia-cors-lyra-accretion (npm)
- Nov 13, 2025
Malicious code in cordelia-babel-on-proxima (npm)
- Nov 13, 2025
Malicious code in cordelia-async-chariklo-farout (npm)
- Nov 13, 2025
Malicious code in convict-writable-webpack-cosmogenic (npm)
- Nov 13, 2025
Malicious code in convict-ultra-paleoceanography-carpo (npm)
- Nov 13, 2025
Malicious code in convict-thuban-blackhole-chromedriver (npm)
- Nov 13, 2025
Malicious code in convict-spawn-gravitationalwave-stream (npm)
- Nov 13, 2025
Malicious code in convict-quantum-hermes-enif (npm)
- Nov 13, 2025
Malicious code in convict-private-cors-superagent (npm)
- Nov 13, 2025
Malicious code in convict-miranda-deimos-astrochemistry (npm)
- Nov 13, 2025
Malicious code in convict-axios-cosmogenic-miranda (npm)
- Nov 13, 2025
Malicious code in container-void-virtualize-transpile-try (npm)
- Nov 13, 2025
Malicious code in container-tree-signal-notify-permission (npm)
- Nov 13, 2025
Malicious code in container-error-sanitize-authenticate-sigma (npm)
- Nov 13, 2025
Malicious code in container-encrypt-kappa-virtualize-old (npm)
- Nov 13, 2025
Malicious code in container-bundle-wind-private-resolve (npm)
- Nov 13, 2025
Malicious code in container-async-awk-zeta-runtime (npm)
- Nov 13, 2025
Malicious code in configstore-quark-sync-callback (npm)
- Nov 13, 2025
Malicious code in configstore-mongoose-interferometry-terser-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in configstore-mensa-airbnb-quark (npm)
- Nov 13, 2025
Malicious code in configstore-jabbah-koa-public (npm)
- Nov 13, 2025
Malicious code in configstore-hermes-development-update (npm)
- Nov 13, 2025
Malicious code in configstore-eslint-config-celeste-archaeometry (npm)
- Nov 13, 2025
Malicious code in configstore-centaurus-writable-express (npm)
- Nov 13, 2025
Malicious code in config-xml-sirius-config (npm)
- Nov 13, 2025
Malicious code in config-regulus-auth-ophiuchus (npm)
- Nov 13, 2025
Malicious code in config-pipe-promise-start (npm)
- Nov 13, 2025
Malicious code in config-ophiuchus-levels-version (npm)
- Nov 13, 2025
Malicious code in config-event-install-lacerta (npm)
- Nov 13, 2025
Malicious code in config-elara-leda-nucleosynthesis (npm)
- Nov 13, 2025
Malicious code in config-darkenergy-heliophysics-quark (npm)
- Nov 13, 2025
Malicious code in config-dactyl-foundation-sirius (npm)
- Nov 13, 2025
Malicious code in config-cross-env-nova-bunyan (npm)
Page 357 of 4,814