Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,355 total in npm · sorted newest first- Aug 14, 2025
Malicious code in @frozen-ui/http (npm)
- Aug 14, 2025
Malicious code in @frozen-ui/hint (npm)
- Aug 14, 2025
Malicious code in @frozen-ui/feedback (npm)
- Aug 14, 2025
Malicious code in @frozen-ui/eslint-config (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/utils (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/user-service (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/types (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/subscriptions-service (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/share-service (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/selectors (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/projects-service (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/positions-service (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/playwright-utils (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/playwright-slack-reporter (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/playwright-helpers (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/playwright-components (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/oti-service (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/notes-service (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/ga-store-playwright (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/ga-store-base (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/config-commons (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/codeceptjs (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/axios-client (npm)
- Aug 14, 2025
Malicious code in @frozen-team-qa/auth-service (npm)
- Aug 14, 2025
Malicious code in @frozen-team/ui-test-core (npm)
- Aug 14, 2025
Malicious code in @frozen-team/rp-agent-js-codecept (npm)
- Aug 14, 2025
Malicious code in @frozen-team/eslint-config-qa (npm)
- Aug 14, 2025
Malicious code in @frozen-team/eslint-config-base (npm)
- Aug 14, 2025
Malicious code in @frozen-team/eslint-config (npm)
- Aug 14, 2025
Malicious code in @frozen-team/deploy-to-gcs (npm)
- Aug 14, 2025
Malicious code in @frozen-team/deploy-log (npm)
- Aug 14, 2025
Malicious code in @framgia/viblo-accounts-auth-web (npm)
- Aug 14, 2025
Malicious code in @fmcc-web-platform/react-components (npm)
- Aug 14, 2025
Malicious code in @fmcc-web-platform/platform-experience-lib (npm)
- Aug 14, 2025
Malicious code in @fm-plugin/dynamic-module-provider (npm)
- Aug 14, 2025
Malicious code in @flutter-global/uki-gaming-commits (npm)
- Aug 14, 2025
Malicious code in @fe-lib/auth (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/voluptatibus-ab (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/voluptatem-ipsam (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/voluptas-reiciendis-veritatis-suscipit (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/vero-neque-tempore (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/veritatis-modi (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/veniam-qui-labore (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/unde-tempore-corporis (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/unde-ad-perferendis (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/ullam-dolorum-sit (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/tempore-repudiandae-ullam-nulla (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/sit-minus-sapiente (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/sequi-ullam-est (npm)
- Aug 14, 2025
Malicious code in @erboladaiteas/saepe-veritatis-quos (npm)
Page 5180 of 6,668