Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,327 total in npm · sorted newest first- Aug 14, 2025
Malicious code in @antwiib001/ullam-atque-sequi (npm)
- Aug 14, 2025
Malicious code in @antwiib001/quae-dolores-maxime (npm)
- Aug 14, 2025
Malicious code in @antwiib001/pariatur-voluptatibus-sapiente (npm)
- Aug 14, 2025
Malicious code in @antwiib001/odit-voluptatibus-sit (npm)
- Aug 14, 2025
Malicious code in @antwiib001/nobis-assumenda-velit (npm)
- Aug 14, 2025
Malicious code in @antwiib001/natus-et-unde (npm)
- Aug 14, 2025
Malicious code in @antwiib001/molestias-sunt-architecto (npm)
- Aug 14, 2025
Malicious code in @antwiib001/modi-corporis-laudantium (npm)
- Aug 14, 2025
Malicious code in @antwiib001/maxime-nostrum-voluptas (npm)
- Aug 14, 2025
Malicious code in @antwiib001/magnam-aliquid-quisquam (npm)
- Aug 14, 2025
Malicious code in @antwiib001/iure-ipsa-deserunt (npm)
- Aug 14, 2025
Malicious code in @antwiib001/dolorem-nobis-quaerat (npm)
- Aug 14, 2025
Malicious code in @antwiib001/consequatur-qui-incidunt (npm)
- Aug 14, 2025
Malicious code in @antwiib001/accusamus-cupiditate-eligendi (npm)
- Aug 14, 2025
Malicious code in @amber-team/webpack-config (npm)
- Aug 14, 2025
Malicious code in @amber-team/web-platform-utils (npm)
- Aug 14, 2025
Malicious code in @amber-team/tsconfig (npm)
- Aug 14, 2025
Malicious code in @amber-team/stylelint-config (npm)
- Aug 14, 2025
Malicious code in @amber-team/storybook-utils (npm)
- Aug 14, 2025
Malicious code in @amber-team/standard-utils (npm)
- Aug 14, 2025
Malicious code in @amber-team/social-content-ai-widget (npm)
- Aug 14, 2025
Malicious code in @amber-team/sellerly-theme (npm)
- Aug 14, 2025
Malicious code in @amber-team/sellerly-icons (npm)
- Aug 14, 2025
Malicious code in @amber-team/router5-plugins (npm)
- Aug 14, 2025
Malicious code in @amber-team/report-bundle-diff (npm)
- Aug 14, 2025
Malicious code in @amber-team/remote-styles (npm)
- Aug 14, 2025
Malicious code in @amber-team/react-utils (npm)
- Aug 14, 2025
Malicious code in @amber-team/react-modal-stack (npm)
- Aug 14, 2025
Malicious code in @amber-team/react-mobx-utils (npm)
- Aug 14, 2025
Malicious code in @amber-team/react-event-tracking (npm)
- Aug 14, 2025
Malicious code in @amber-team/react-email (npm)
- Aug 14, 2025
Malicious code in @amber-team/mobx-utils (npm)
- Aug 14, 2025
Malicious code in @amber-team/log-uptime-deploy (npm)
- Aug 14, 2025
Malicious code in @amber-team/gatsby-plugin-semrush2 (npm)
- Aug 14, 2025
Malicious code in @amber-team/gatsby-plugin-semcore (npm)
- Aug 14, 2025
Malicious code in @amber-team/figma-utils (npm)
- Aug 14, 2025
Malicious code in @amber-team/export-events-to-sheet (npm)
- Aug 14, 2025
Malicious code in @amber-team/eslint-plugin (npm)
- Aug 14, 2025
Malicious code in @amber-team/eslint-config (npm)
- Aug 14, 2025
Malicious code in @amber-team/deploy-to-mailer (npm)
- Aug 14, 2025
Malicious code in @amber-team/deploy-to-gcs (npm)
- Aug 14, 2025
Malicious code in @amber-team/create-loki-report (npm)
- Aug 14, 2025
Malicious code in @amber-team/ati-widget (npm)
- Aug 14, 2025
Malicious code in @amber-team/app-center-utils (npm)
- Aug 14, 2025
Malicious code in @amber-team/amazon-utils (npm)
- Aug 14, 2025
Malicious code in @ag2rlamondiale/appversion-generator (npm)
- Aug 14, 2025
Malicious code in @adzu/jshost-events (npm)
- Aug 14, 2025
Malicious code in @adzu/common (npm)
- Aug 14, 2025
Malicious code in @abg-mec/fwk-fe-devcraft (npm)
- Aug 14, 2025
Malicious code in 9xkt8l (npm)
Page 5197 of 6,667