Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,736 total in npm · sorted newest first- Nov 13, 2025
Malicious code in blazar-quark-publish-quito (npm)
- Nov 13, 2025
Malicious code in blazar-pegasus-quark-grunt (npm)
- Nov 13, 2025
Malicious code in blazar-markdown-umbriel-filament (npm)
- Nov 13, 2025
Malicious code in blazar-ganymede-nebula-bunyan (npm)
- Nov 13, 2025
Malicious code in blazar-draco-mesosphere-mineralogy (npm)
- Nov 13, 2025
Malicious code in blazar-apollo-async-barnard (npm)
- Nov 13, 2025
Malicious code in blackhole-prettier-plugin-markdown-achernar-redis (npm)
- Nov 13, 2025
Malicious code in blackhole-jupiter-spectron-webdriver-meteor (npm)
- Nov 13, 2025
Malicious code in biotechnology-testcafe-cygnus-auriga (npm)
- Nov 13, 2025
Malicious code in biotechnology-planckscale-nightwatch-bellatrix (npm)
- Nov 13, 2025
Malicious code in biotechnology-halley-redgiant-sirius (npm)
- Nov 13, 2025
Malicious code in biotechnology-enceladus-jovian-changelog (npm)
- Nov 13, 2025
Malicious code in biotechnology-draco-webpack-bellatrix (npm)
- Nov 13, 2025
Malicious code in biotechnology-corvus-phoebe-inquirer (npm)
- Nov 13, 2025
Malicious code in biotechnology-apollo-rollup-plugin-nodemon (npm)
- Nov 13, 2025
Malicious code in biosignature-winston-xanthus-octans (npm)
- Nov 13, 2025
Malicious code in biosignature-spawn-slidev-envconfig (npm)
- Nov 13, 2025
Malicious code in biosignature-rollup-polaris-boson (npm)
- Nov 13, 2025
Malicious code in biosignature-quasar-galaxy-charon (npm)
- Nov 13, 2025
Malicious code in biosignature-nestjs-publish-morgan (npm)
- Nov 13, 2025
Malicious code in biosignature-jasmine-solis-promise (npm)
- Nov 13, 2025
Malicious code in biosignature-install-mocha-vortex (npm)
- Nov 13, 2025
Malicious code in biosignature-enif-element-ui-biohacking (npm)
- Nov 13, 2025
Malicious code in bionics-geochemistry-request-supercluster (npm)
- Nov 13, 2025
Malicious code in biomimicry-kuiperbelt-castor-hugo (npm)
- Nov 13, 2025
Malicious code in biomimicry-epimetheus-thermochronology-native (npm)
- Nov 13, 2025
Malicious code in biomimicry-epigenetics-rimraf-html-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in biomimicry-decoherence-paleomagnetism-despina (npm)
- Nov 13, 2025
Malicious code in bioinformatics-proxima-uglify-js-rimraf (npm)
- Nov 13, 2025
Malicious code in bioinformatics-pino-pretty-mutation-vuepress (npm)
- Nov 13, 2025
Malicious code in bioinformatics-draco-alphard-tailwindcss (npm)
- Nov 13, 2025
Malicious code in bioinformatics-async-wezen-quasar (npm)
- Nov 13, 2025
Malicious code in bioinformatics-achernar-spawn-ganymede (npm)
- Nov 13, 2025
Malicious code in biohacking-release-it-augmentedreality-janus (npm)
- Nov 13, 2025
Malicious code in biohacking-mysql-registry-levels (npm)
- Nov 13, 2025
Malicious code in biohacking-membrane-json-convict (npm)
- Nov 13, 2025
Malicious code in biohacking-hexo-nebula-non-blocking (npm)
- Nov 13, 2025
Malicious code in biohacking-axios-pegasus-sirius (npm)
- Nov 13, 2025
Malicious code in biogeochemistry-xenos-nashira-petrology (npm)
- Nov 13, 2025
Malicious code in biogeochemistry-wasat-polaris-meissa (npm)
- Nov 13, 2025
Malicious code in biogeochemistry-test-express-css-minimizer-webpack-plugin (npm)
- Nov 13, 2025
Malicious code in biogeochemistry-remark-module-cygnus (npm)
- Nov 13, 2025
Malicious code in biogeochemistry-multiverse-xo-regulus (npm)
- Nov 13, 2025
Malicious code in biogeochemistry-carpo-alphard-pulsar (npm)
- Nov 13, 2025
Malicious code in big-tau-stack-root-compress (npm)
- Nov 13, 2025
Malicious code in big-static-delta-private-cache (npm)
- Nov 13, 2025
Malicious code in big-star-kappa-alert-report (npm)
- Nov 13, 2025
Malicious code in big-monitor-moon-iota-warn (npm)
- Nov 13, 2025
Malicious code in big-grid-cron-parse-fork (npm)
- Nov 13, 2025
Malicious code in big-data-shell-omega-reject (npm)
Page 368 of 4,815