Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,327 total in npm · sorted newest first- Aug 14, 2025
Malicious code in @crabas0npm/saepe-quibusdam-odio (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/saepe-enim-possimus-ut (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/saepe-deleniti-quaerat (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/rerum-sed-corrupti (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/rerum-aspernatur-omnis (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/rerum-amet-voluptas (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/rerum-ad-praesentium (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/repudiandae-sint-molestiae (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/repudiandae-hic-quia (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/repudiandae-error-dolores-magnam (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/reprehenderit-aliquam-quam (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/repellendus-quos-occaecati-iste (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/repellendus-provident-ipsa (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/repellendus-magni-magni (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/repellat-sed-animi (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/repellat-expedita-velit (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/repellat-eligendi-ea-quisquam (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/repellat-aperiam-quae (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/rem-vel-aut-pariatur (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/rem-tenetur-velit (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/rem-necessitatibus-necessitatibus (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/rem-iusto-ullam (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/rem-ducimus-laboriosam-in (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/rem-atque-nemo (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/reiciendis-illo-deleniti (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/reiciendis-fugiat-nemo (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/reiciendis-consequuntur-atque (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/recusandae-repudiandae-commodi (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/recusandae-eos-recusandae (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/recusandae-autem-tenetur-perferendis (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/ratione-repellendus-ad-officiis (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/ratione-id-modi (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quos-accusamus-eaque-placeat (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quod-temporibus-harum (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quod-error-mollitia-impedit (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quod-at-error (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quod-aspernatur-quisquam (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quod-aliquam-quas (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quo-reiciendis-voluptatum (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quo-quasi-neque (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quo-mollitia-sunt-vel (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quisquam-quia-perspiciatis (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quisquam-nemo-dolorem (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quisquam-iste-debitis (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quisquam-earum-voluptate (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quisquam-blanditiis-fuga (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quis-saepe-tempora (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quis-natus-atque (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quis-natus-aliquam-non (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/quis-eveniet-possimus-quasi (npm)
Page 5188 of 6,667