Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,317 total in npm · sorted newest first- Aug 14, 2025
Malicious code in xylophone-myth-wbx282-project (npm)
- Aug 14, 2025
Malicious code in xylophone-lagoon-zed258-project (npm)
- Aug 14, 2025
Malicious code in xylophone-lagoon-uel926-project (npm)
- Aug 14, 2025
Malicious code in xylophone-kiwi-gip963-project (npm)
- Aug 14, 2025
Malicious code in xylophone-jade-rtp572-project (npm)
- Aug 14, 2025
Malicious code in xylophone-jade-gpn443-project (npm)
- Aug 14, 2025
Malicious code in xylophone-icicle-rxq484-project (npm)
- Aug 14, 2025
Malicious code in xylophone-iceberg-pvw669-project (npm)
- Aug 14, 2025
Malicious code in xylophone-i1ejc-v5paf-paradise-project (npm)
- Aug 14, 2025
Malicious code in xylophone-hk8vp-dh7w4-keystone-project (npm)
- Aug 14, 2025
Malicious code in xylophone-harbor-ybx713-project (npm)
- Aug 14, 2025
Malicious code in xylophone-glade-wav991-project (npm)
- Aug 14, 2025
Malicious code in xylophone-glacier-hup490-project (npm)
- Aug 14, 2025
Malicious code in xylophone-fir-wctn (npm)
- Aug 14, 2025
Malicious code in xylophone-fern-ats232-project (npm)
- Aug 14, 2025
Malicious code in xylophone-falcon-gxi313-project (npm)
- Aug 14, 2025
Malicious code in xylophone-everest-jjh399-project (npm)
- Aug 14, 2025
Malicious code in xylophone-dragon-aai930-project (npm)
- Aug 14, 2025
Malicious code in xylophone-desert-nun094-project (npm)
- Aug 14, 2025
Malicious code in xylophone-brook-uti375-project (npm)
- Aug 14, 2025
Malicious code in xylophone-blossom-owg756-project (npm)
- Aug 14, 2025
Malicious code in xylophone-bamboo-yua432-project (npm)
- Aug 14, 2025
Malicious code in xylophone-aa5b0-k5qpo-obsidian-project (npm)
- Aug 14, 2025
Malicious code in xylophone-5x0y9-ynf2p-wander-project (npm)
- Aug 14, 2025
Malicious code in xyatwbkqghlznemj (npm)
- Aug 14, 2025
Malicious code in xxssblog (npm)
- Aug 14, 2025
Malicious code in xwusanjiu-dangan-vol8 (npm)
- Aug 14, 2025
Malicious code in xwusanjiu-dangan-vol7 (npm)
- Aug 14, 2025
Malicious code in xwusanjiu-dangan-vol6 (npm)
- Aug 14, 2025
Malicious code in xwusanjiu-dangan-vol5 (npm)
- Aug 14, 2025
Malicious code in xwusanjiu-dangan-vol4 (npm)
- Aug 14, 2025
Malicious code in xwqkgamldejucpnk (npm)
- Aug 14, 2025
Malicious code in xwkfecdisltbrhmj (npm)
- Aug 14, 2025
Malicious code in xwfcsgnhjqioedap (npm)
- Aug 14, 2025
Malicious code in xwenkend (npm)
- Aug 14, 2025
Malicious code in xweibophp (npm)
- Aug 14, 2025
Malicious code in xwdyoajlimnrcevk (npm)
- Aug 14, 2025
Malicious code in xwdupfstoqceagrm (npm)
- Aug 14, 2025
Malicious code in xutrdabzpgyqlnwe (npm)
- Aug 14, 2025
Malicious code in xurbansimsx2025 (npm)
- Aug 14, 2025
Malicious code in xurbansimsx (npm)
- Aug 14, 2025
Malicious code in xuntar (npm)
- Aug 14, 2025
Malicious code in xunboge-geshengxue (npm)
- Aug 14, 2025
Malicious code in xuicom (npm)
- Aug 14, 2025
Malicious code in xuexing-yuxingzuo-volo (npm)
- Aug 14, 2025
Malicious code in xuexing-yuxingzuo-volb (npm)
- Aug 14, 2025
Malicious code in xuexing-yuxingzuo-volab (npm)
- Aug 14, 2025
Malicious code in xuexing-yuxingzuo-vola (npm)
- Aug 14, 2025
Malicious code in xuexing-xingzuo-shengxiao-quanjiemi (npm)
- Aug 14, 2025
Malicious code in xuehui-taluode-shiliu-tangke (npm)
Page 5223 of 6,667