Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,736 total in npm · sorted newest first- Nov 13, 2025
Malicious code in boson-build-tachyon-solis (npm)
- Nov 13, 2025
Malicious code in boson-apex-parcel-cybernetics (npm)
- Nov 13, 2025
Malicious code in borealis-rigel-string-exoplanetology (npm)
- Nov 13, 2025
Malicious code in borealis-promise-spinner-ora (npm)
- Nov 13, 2025
Malicious code in borealis-hermes-bellatrix-geochronology (npm)
- Nov 13, 2025
Malicious code in borealis-hercules-ora-lyra (npm)
- Nov 13, 2025
Malicious code in borealis-dagda-impulse-pm2 (npm)
- Nov 13, 2025
Malicious code in bootstrap-solis-bulma-zooarchaeology (npm)
- Nov 13, 2025
Malicious code in bootstrap-semantic-release-pulsar-koa (npm)
- Nov 13, 2025
Malicious code in bootstrap-kastra-event-scripts (npm)
- Nov 13, 2025
Malicious code in bootstrap-futurology-bootstrap-html-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in bootstrap-fusion-loop-restart (npm)
- Nov 13, 2025
Malicious code in bootstrap-forever-uranology-colors (npm)
- Nov 13, 2025
Malicious code in bootstrap-cluster-fornax-link (npm)
- Nov 13, 2025
Malicious code in bootes-transform-nuxtjs-proxima (npm)
- Nov 13, 2025
Malicious code in bootes-terser-local-sqlite (npm)
- Nov 13, 2025
Malicious code in bootes-reveal-md-cache-antares (npm)
- Nov 13, 2025
Malicious code in bootes-global-luna-galaxy (npm)
- Nov 13, 2025
Malicious code in bootes-config-docusaurus-ultra (npm)
- Nov 13, 2025
Malicious code in boolean-zeta-fire-omega-lambda (npm)
- Nov 13, 2025
Malicious code in boolean-xml-encrypt-hash-enum (npm)
- Nov 13, 2025
Malicious code in boolean-reject-balance-sun-slow (npm)
- Nov 13, 2025
Malicious code in boolean-fork-uglify-dog-sanitize (npm)
- Nov 13, 2025
Malicious code in boolean-double-benchmark-star-node (npm)
- Nov 13, 2025
Malicious code in boolean-balance-delta-visualize-resolve (npm)
- Nov 13, 2025
Malicious code in book-web-deploy-object-byte (npm)
- Nov 13, 2025
Malicious code in book-sanitize-cat-cold-class (npm)
- Nov 13, 2025
Malicious code in book-good-old-sun-test (npm)
- Nov 13, 2025
Malicious code in book-earth-runtime-delta-chi (npm)
- Nov 13, 2025
Malicious code in book-data-short-index-object (npm)
- Nov 13, 2025
Malicious code in book-compile-try-fork-kernel (npm)
- Nov 13, 2025
Malicious code in book-boolean-runtime-grep-root (npm)
- Nov 13, 2025
Malicious code in blueshift-toml-bellatrix-blueshift (npm)
- Nov 13, 2025
Malicious code in blueshift-standard-altair-higgs (npm)
- Nov 13, 2025
Malicious code in blueshift-publish-carina-nconf (npm)
- Nov 13, 2025
Malicious code in blueshift-perturbation-centauri-paleoceanography (npm)
- Nov 13, 2025
Malicious code in blueshift-lynx-dotenv-safe-morgan (npm)
- Nov 13, 2025
Malicious code in blueshift-kuiperbelt-asteroid-dendrochronology (npm)
- Nov 13, 2025
Malicious code in blueshift-exoplanet-buffer-primatology (npm)
- Nov 13, 2025
Malicious code in blueshift-canopus-leda-higgs (npm)
- Nov 13, 2025
Malicious code in blitz-nuxtjs-cosmicray-paleoceanography (npm)
- Nov 13, 2025
Malicious code in blitz-materialize-link-lint-staged (npm)
- Nov 13, 2025
Malicious code in blitz-hawkingradiation-helmet-postgres (npm)
- Nov 13, 2025
Malicious code in blitz-ganymede-aether-gridsome (npm)
- Nov 13, 2025
Malicious code in blitz-eslint-plugin-csrf-indus (npm)
- Nov 13, 2025
Malicious code in blaze-transport-genomics-telesto (npm)
- Nov 13, 2025
Malicious code in blaze-transport-eridanus-singularitarianism (npm)
- Nov 13, 2025
Malicious code in blaze-figures-auth0-proxima (npm)
- Nov 13, 2025
Malicious code in blaze-farout-module-transport (npm)
- Nov 13, 2025
Malicious code in blaze-antares-taurus-prompts (npm)
Page 367 of 4,815