Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,327 total in npm · sorted newest first- Aug 14, 2025
Malicious code in @epc-libraries/common-types (npm)
- Aug 14, 2025
Malicious code in @epc-libraries/common-api-responses (npm)
- Aug 14, 2025
Malicious code in @epc-infra/vpc-stack (npm)
- Aug 14, 2025
Malicious code in @epc-infra/lambda-utils (npm)
- Aug 14, 2025
Malicious code in @epc-infra/edge-stack (npm)
- Aug 14, 2025
Malicious code in @epc-infra/cognito-stack (npm)
- Aug 14, 2025
Malicious code in @epc-infra/cicd-stack (npm)
- Aug 14, 2025
Malicious code in @epc-apps/api-version-test (npm)
- Aug 14, 2025
Malicious code in @ebx-auth/ebx-clientauth-frontend-sdk (npm)
- Aug 14, 2025
Malicious code in @dvpe/3dconcepts-ui (npm)
- Aug 14, 2025
Malicious code in @dramateas/veritatis-quidem-quis-odit (npm)
- Aug 14, 2025
Malicious code in @dramateas/ut-distinctio-aliquam-est (npm)
- Aug 14, 2025
Malicious code in @dramateas/unde-porro-quidem-distinctio (npm)
- Aug 14, 2025
Malicious code in @dramateas/similique-vero-saepe-delectus (npm)
- Aug 14, 2025
Malicious code in @dramateas/similique-soluta-ab-rem (npm)
- Aug 14, 2025
Malicious code in @dramateas/similique-facere-mollitia-quibusdam (npm)
- Aug 14, 2025
Malicious code in @dramateas/saepe-necessitatibus-quam-tempora (npm)
- Aug 14, 2025
Malicious code in @dramateas/recusandae-perferendis-accusantium-architecto (npm)
- Aug 14, 2025
Malicious code in @dramateas/recusandae-molestiae-mollitia-modi (npm)
- Aug 14, 2025
Malicious code in @dramateas/quos-aut-natus-odit (npm)
- Aug 14, 2025
Malicious code in @dramateas/quis-nisi-error-quos (npm)
- Aug 14, 2025
Malicious code in @dramateas/odit-corporis-adipisci-laboriosam (npm)
- Aug 14, 2025
Malicious code in @dramateas/nulla-voluptatibus-aliquid-quia (npm)
- Aug 14, 2025
Malicious code in @dramateas/nihil-vero-cum-tempore (npm)
- Aug 14, 2025
Malicious code in @dramateas/magni-explicabo-esse-magnam (npm)
- Aug 14, 2025
Malicious code in @dramateas/iure-possimus-animi-ducimus (npm)
- Aug 14, 2025
Malicious code in @dramateas/fuga-dolore-provident-excepturi (npm)
- Aug 14, 2025
Malicious code in @dramateas/facilis-quae-omnis-consequatur (npm)
- Aug 14, 2025
Malicious code in @dramateas/expedita-quasi-eligendi-omnis (npm)
- Aug 14, 2025
Malicious code in @dramateas/blanditiis-molestias-exercitationem-quis (npm)
- Aug 14, 2025
Malicious code in @dramateas/at-nam-vel-cum (npm)
- Aug 14, 2025
Malicious code in @dramaorg/occaecati-alias (npm)
- Aug 14, 2025
Malicious code in @dramaorg/magnam-sit-neque (npm)
- Aug 14, 2025
Malicious code in @dramaorg/facilis-maiores (npm)
- Aug 14, 2025
Malicious code in @dq-ui/source (npm)
1 compromised version
- Aug 14, 2025
Malicious code in @diotobtea/voluptatibus-numquam-ratione-consequatur (npm)
- Aug 14, 2025
Malicious code in @diotobtea/velit-sunt (npm)
- Aug 14, 2025
Malicious code in @diotobtea/vel-cupiditate-ea (npm)
- Aug 14, 2025
Malicious code in @diotobtea/tempora-vitae-dolorem-molestias (npm)
- Aug 14, 2025
Malicious code in @diotobtea/suscipit-temporibus-commodi (npm)
- Aug 14, 2025
Malicious code in @diotobtea/sunt-quos-et (npm)
- Aug 14, 2025
Malicious code in @diotobtea/soluta-ea-minus (npm)
- Aug 14, 2025
Malicious code in @diotobtea/sit-adipisci-impedit (npm)
- Aug 14, 2025
Malicious code in @diotobtea/sint-voluptate-molestiae (npm)
- Aug 14, 2025
Malicious code in @diotobtea/sequi-nulla-deleniti (npm)
- Aug 14, 2025
Malicious code in @diotobtea/rerum-possimus-quo-ipsum (npm)
- Aug 14, 2025
Malicious code in @diotobtea/repudiandae-atque-non-aspernatur (npm)
- Aug 14, 2025
Malicious code in @diotobtea/reprehenderit-alias-cum-consectetur (npm)
- Aug 14, 2025
Malicious code in @diotobtea/repellendus-provident-magni (npm)
- Aug 14, 2025
Malicious code in @diotobtea/repellat-veniam-temporibus (npm)
Page 5182 of 6,667