Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,736 total in npm · sorted newest first- Nov 13, 2025
Malicious code in big-data-char-xi-kernel (npm)
- Nov 13, 2025
Malicious code in betelgeuse-taurus-nestjs-whitedwarf (npm)
- Nov 13, 2025
Malicious code in betelgeuse-sadr-antd-leda (npm)
- Nov 13, 2025
Malicious code in betelgeuse-perseus-despina-radiant (npm)
- Nov 13, 2025
Malicious code in betelgeuse-octans-aether-less (npm)
- Nov 13, 2025
Malicious code in betelgeuse-nodejs-hugo-flare (npm)
- Nov 13, 2025
Malicious code in betelgeuse-metalsmith-frontend-tethys (npm)
- Nov 13, 2025
Malicious code in betelgeuse-gammarayburst-puppeteer-rehype (npm)
- Nov 13, 2025
Malicious code in betelgeuse-frontend-titan-yildun (npm)
- Nov 13, 2025
Malicious code in betelgeuse-development-heliophysics-cordelia (npm)
- Nov 13, 2025
Malicious code in betelgeuse-dactyl-rollup-plugin-quasarjet (npm)
- Nov 13, 2025
Malicious code in betelgeuse-csrf-aldebaran-json (npm)
- Nov 13, 2025
Malicious code in betelgeuse-cassini-lyra-firebase (npm)
- Nov 13, 2025
Malicious code in betelgeuse-backend-primatology-query (npm)
- Nov 13, 2025
Malicious code in betelgeuse-antd-magellan-xanthus (npm)
- Nov 13, 2025
Malicious code in beta-try-omicron-orchestrate-analyze (npm)
- Nov 13, 2025
Malicious code in beta-orchestrate-slow-void-table (npm)
- Nov 13, 2025
Malicious code in beta-moon-fast-authorize-deploy (npm)
- Nov 13, 2025
Malicious code in beta-key-promise-socket-file (npm)
- Nov 13, 2025
Malicious code in beta-grep-cron-omega-validate (npm)
- Nov 13, 2025
Malicious code in beta-error-rho-authenticate-tree (npm)
- Nov 13, 2025
Malicious code in beta-enum-notify-view-stack (npm)
- Nov 13, 2025
Malicious code in benchmark-view-mu-cat-virtualize (npm)
- Nov 13, 2025
Malicious code in benchmark-refactor-secure-scale-array (npm)
- Nov 13, 2025
Malicious code in bellatrix-websockets-filament-biohacking (npm)
- Nov 13, 2025
Malicious code in bellatrix-quantum-inquirer-child-process (npm)
- Nov 13, 2025
Malicious code in bellatrix-pulsar-bionics-cryovolcano (npm)
- Nov 13, 2025
Malicious code in bellatrix-proteomics-meissa-redis (npm)
- Nov 13, 2025
Malicious code in bellatrix-prompts-webpack-paleobotany (npm)
- Nov 13, 2025
Malicious code in bellatrix-panspermia-websockets-gulp (npm)
- Nov 13, 2025
Malicious code in bellatrix-odin-redis-commitlint (npm)
- Nov 13, 2025
Malicious code in bellatrix-mira-europa-commitlint (npm)
- Nov 13, 2025
Malicious code in bellatrix-local-puppeteer-epigenetics (npm)
- Nov 13, 2025
Malicious code in bellatrix-gulp-barnard-dagda (npm)
- Nov 13, 2025
Malicious code in bellatrix-command-testcafe-pino-pretty (npm)
- Nov 13, 2025
Malicious code in bellatrix-child-process-playwright-geodynamo (npm)
- Nov 13, 2025
Malicious code in bellatrix-bunyan-neptune-hydra (npm)
- Nov 13, 2025
Malicious code in bellatrix-axios-spica-geoarchaeology (npm)
- Nov 13, 2025
Malicious code in bash-xml-transpile-good-catch (npm)
- Nov 13, 2025
Malicious code in bash-water-resolve-unix-error (npm)
- Nov 13, 2025
Malicious code in bash-unix-rho-sigma-quick (npm)
- Nov 13, 2025
Malicious code in bash-serialize-decode-grid-sudo (npm)
- Nov 13, 2025
Malicious code in bash-runtime-log-static-java (npm)
- Nov 13, 2025
Malicious code in bash-load-fast-unix-route (npm)
- Nov 13, 2025
Malicious code in baryon-sublimation-apollo-shelljs (npm)
- Nov 13, 2025
Malicious code in baryon-perturbation-javascript-pyxis (npm)
- Nov 13, 2025
Malicious code in baryon-ini-biomimicry-entanglement (npm)
- Nov 13, 2025
Malicious code in baryon-helmet-apollo-meteor (npm)
- Nov 13, 2025
Malicious code in baryon-eslint-ariel-iota (npm)
- Nov 13, 2025
Malicious code in baryon-antares-leda-cosmicsilence (npm)
Page 369 of 4,815