Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,367 total in npm · sorted newest first- Aug 14, 2025
Malicious code in @scdb/simple-http (npm)
- Aug 14, 2025
Malicious code in @scdb/silver-octo-meme (npm)
- Aug 14, 2025
Malicious code in @scdb/refactored-sniffle (npm)
- Aug 14, 2025
Malicious code in @scdb/improved-tribble (npm)
- Aug 14, 2025
Malicious code in @scdb/glowing-potato (npm)
- Aug 14, 2025
Malicious code in @scdb/friendly-octo-couscous (npm)
- Aug 14, 2025
Malicious code in @scdb/didactic-spoon (npm)
- Aug 14, 2025
Malicious code in @scdb/curly-robot (npm)
- Aug 14, 2025
Malicious code in @scdb/crispy-tribble (npm)
- Aug 14, 2025
Malicious code in @sbanken/ui-global-test (npm)
- Aug 14, 2025
Malicious code in @sbanken/ui-global (npm)
- Aug 14, 2025
Malicious code in @ruby-team/sst-ui-commons (npm)
- Aug 14, 2025
Malicious code in @ruby-team/sst-tasks (npm)
- Aug 14, 2025
Malicious code in @roosterbank/shared-utils (npm)
- Aug 14, 2025
Malicious code in @remove-bg/remove-bg-tools (npm)
- Aug 14, 2025
Malicious code in @react-native-website/update-redirects (npm)
- Aug 14, 2025
Malicious code in @react-native-website/lint-examples (npm)
- Aug 14, 2025
Malicious code in @protos-team/frontend-utils (npm)
- Aug 14, 2025
Malicious code in @protos-team/frontend-server (npm)
- Aug 14, 2025
Malicious code in @protos-team/frontend-primitives (npm)
- Aug 14, 2025
Malicious code in @protos-team/frontend-platform (npm)
- Aug 14, 2025
Malicious code in @protos-team/frontend-config (npm)
- Aug 14, 2025
Malicious code in @protos-team/frontend-common (npm)
- Aug 14, 2025
Malicious code in @pricing/c2g-ui-components (npm)
- Aug 14, 2025
Malicious code in @prathvi2002/simple-npm-package (npm)
1 compromised version
- Aug 14, 2025
Malicious code in @povsicoenpm/vitae-adipisci-officia-aperiam (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/totam-libero-tempore-voluptate (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/temporibus-quod-voluptatem-magni (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/soluta-quasi-blanditiis-quibusdam (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/quam-harum-officia-nesciunt (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/quam-blanditiis-nesciunt-libero (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/quaerat-architecto-eaque-tempore (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/perferendis-quas-et-rem (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/necessitatibus-modi-eveniet-deserunt (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/illum-ex-totam-voluptatem (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/enim-nulla-quas-unde (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/eaque-debitis-perferendis-voluptatum (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/dolorem-deleniti-delectus-molestiae (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/distinctio-nobis-animi-eos (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/consequatur-aut-harum-veritatis (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/animi-quae-necessitatibus-odio (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/accusantium-officiis-sint-ullam (npm)
- Aug 14, 2025
Malicious code in @povsicoenpm/ab-voluptas-maiores-sapiente (npm)
- Aug 14, 2025
Malicious code in @post-office-placement/screen-space-flags (npm)
- Aug 14, 2025
Malicious code in @pmm/keycloak-factory (npm)
- Aug 14, 2025
Malicious code in @plentific/dashboard (npm)
1 compromised version
- Aug 14, 2025
Malicious code in @plattenbau/element-ui (npm)
- Aug 14, 2025
Malicious code in @plattenbau/component-library (npm)
- Aug 14, 2025
Malicious code in @phamton/api-chat-fanpage-facebook (npm)
- Aug 14, 2025
Malicious code in @pcid/string-utils (npm)
Page 5154 of 6,668