Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,327 total in npm · sorted newest first- Aug 14, 2025
Malicious code in @cseofeedback/feedback-lite (npm)
2 compromised versions
- Aug 14, 2025
Malicious code in @crypto-lib/utils (npm)
- Aug 14, 2025
Malicious code in @crimson-team/typescript-helpers (npm)
- Aug 14, 2025
Malicious code in @crimson-team/test-results-notifier (npm)
- Aug 14, 2025
Malicious code in @crimson-team/sst-test-data-frontend (npm)
- Aug 14, 2025
Malicious code in @crimson-team/sst-shared-types (npm)
- Aug 14, 2025
Malicious code in @crimson-team/sst-shared-components (npm)
- Aug 14, 2025
Malicious code in @crimson-team/semrush-auth (npm)
- Aug 14, 2025
Malicious code in @crimson-team/eslint-plugin (npm)
- Aug 14, 2025
Malicious code in @create-project-container/legacy (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/voluptatum-reiciendis-iure (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/voluptatum-pariatur-libero (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/voluptatum-aspernatur-alias (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/voluptates-voluptas-ad (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/voluptate-aut-ullam (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/vel-sapiente-accusamus (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/vel-ducimus-aperiam (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/temporibus-blanditiis-ea (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/tempora-culpa-minima (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/suscipit-ab-laboriosam (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/sunt-expedita-placeat (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/soluta-mollitia-incidunt (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/soluta-cupiditate-iure (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/soluta-cum-consequuntur (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/sint-repudiandae-expedita (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/sequi-architecto-atque (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/sed-assumenda-atque (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/sapiente-ullam-assumenda (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/reprehenderit-dolor-nemo (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/repellat-unde-illo (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/reiciendis-repellendus-nulla (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/reiciendis-aliquam-necessitatibus (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/recusandae-unde-provident (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/quisquam-occaecati-cum (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/quisquam-error-accusamus (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/quis-totam-harum (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/quis-possimus-harum (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/quis-perspiciatis-veritatis (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/quis-animi-sunt (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/quidem-consequuntur-dolorum (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/qui-soluta-illo (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/qui-in-ratione (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/qui-exercitationem-voluptatum (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/quas-blanditiis-fuga (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/quam-ut-ducimus (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/quaerat-temporibus-perferendis (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/porro-doloribus-eos (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/placeat-adipisci-repellat (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/perspiciatis-voluptate-similique (npm)
- Aug 14, 2025
Malicious code in @crabas0npm2/perspiciatis-temporibus-labore (npm)
Page 5184 of 6,667