Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,736 total in npm · sorted newest first- Nov 13, 2025
Malicious code in capella-proxima-geomorphology-sirius (npm)
- Nov 13, 2025
Malicious code in capella-non-blocking-avior-jabbah (npm)
- Nov 13, 2025
Malicious code in capella-indus-config-relay (npm)
- Nov 13, 2025
Malicious code in capella-cypress-stream-supernova (npm)
- Nov 13, 2025
Malicious code in capella-biotechnology-meteor-start (npm)
- Nov 13, 2025
Malicious code in canopus-odin-scorpius-css-minimizer-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in callisto-sirius-farout-multiverse (npm)
- Nov 13, 2025
Malicious code in callisto-proxima-command-loglevel (npm)
- Nov 13, 2025
Malicious code in callisto-module-module-antares (npm)
- Nov 13, 2025
Malicious code in callisto-meissa-centaurus-sync (npm)
- Nov 13, 2025
Malicious code in callisto-hyperion-norma-firebase (npm)
- Nov 13, 2025
Malicious code in callisto-hyperion-dactyl-equinox (npm)
- Nov 13, 2025
Malicious code in callisto-europa-relay-bootes (npm)
- Nov 13, 2025
Malicious code in callisto-europa-buffer-nodemon (npm)
- Nov 13, 2025
Malicious code in callisto-enif-cryonics-dotenv-parse-variables (npm)
- Nov 13, 2025
Malicious code in callisto-cors-ini-puppeteer (npm)
- Nov 13, 2025
Malicious code in callback-zephyr-semantic-ui-carpo (npm)
- Nov 13, 2025
Malicious code in callback-xanthus-astrochemistry-quantum-computing (npm)
- Nov 13, 2025
Malicious code in callback-uranology-fork-rigel (npm)
- Nov 13, 2025
Malicious code in callback-upgrade-ophiuchus-achernar (npm)
- Nov 13, 2025
Malicious code in callback-typeorm-venus-umbriel (npm)
- Nov 13, 2025
Malicious code in callback-saturnology-taphonomy-radiant (npm)
- Nov 13, 2025
Malicious code in callback-parallax-slides-metabolomics (npm)
- Nov 13, 2025
Malicious code in callback-kastra-wolf-abiogenesis (npm)
- Nov 13, 2025
Malicious code in callback-jekyll-public-nebula (npm)
- Nov 13, 2025
Malicious code in callback-fomalhaut-slidev-library (npm)
- Nov 13, 2025
Malicious code in callback-elara-hadron-jekyll (npm)
- Nov 13, 2025
Malicious code in callback-dynamo-lacerta-chakra-ui (npm)
- Nov 13, 2025
Malicious code in cache-xml-stub-fire-nu (npm)
- Nov 13, 2025
Malicious code in cache-xenos-regulus-rocket (npm)
- Nov 13, 2025
Malicious code in cache-umbra-geoarchaeology-server (npm)
- Nov 13, 2025
Malicious code in cache-simple-awk-sudo-class (npm)
- Nov 13, 2025
Malicious code in cache-publish-decoherence-astroinformatics (npm)
- Nov 13, 2025
Malicious code in cache-phi-public-info-sed (npm)
- Nov 13, 2025
Malicious code in cache-norma-protractor-superflare (npm)
- Nov 13, 2025
Malicious code in cache-meta-root-try-key (npm)
- Nov 13, 2025
Malicious code in cache-mensa-leda-build (npm)
- Nov 13, 2025
Malicious code in cache-less-venus-supercluster (npm)
- Nov 13, 2025
Malicious code in cache-hercules-xerxes-commitizen (npm)
- Nov 13, 2025
Malicious code in cache-cat-index-async-small (npm)
- Nov 13, 2025
Malicious code in byte-runtime-easy-promise-transpile (npm)
- Nov 13, 2025
Malicious code in byte-root-test-kappa-sudo (npm)
- Nov 13, 2025
Malicious code in byte-orchestrate-wind-water-private (npm)
- Nov 13, 2025
Malicious code in byte-nu-monitor-module-static (npm)
- Nov 13, 2025
Malicious code in byte-log-float-cold-analyze (npm)
- Nov 13, 2025
Malicious code in byte-decompress-cold-deploy-wind (npm)
- Nov 13, 2025
Malicious code in byte-assert-finally-hot-sanitize (npm)
- Nov 13, 2025
Malicious code in bunyan-titan-sadr-loop (npm)
- Nov 13, 2025
Malicious code in bunyan-spectron-webdriver-less-magellan (npm)
- Nov 13, 2025
Malicious code in bunyan-resonance-mensa-concurrently (npm)
Page 365 of 4,815