Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,287 total in npm · sorted newest first- Aug 14, 2025
Malicious code in volcano-umbra-z84v (npm)
- Aug 14, 2025
Malicious code in volcano-tundra-pkn173-project (npm)
- Aug 14, 2025
Malicious code in volcano-reef-icq293-project (npm)
- Aug 14, 2025
Malicious code in volcano-quasar-feqa (npm)
- Aug 14, 2025
Malicious code in volcano-nebula-lsp8 (npm)
- Aug 14, 2025
Malicious code in volcano-mountain-ljf786-project (npm)
- Aug 14, 2025
Malicious code in volcano-maple-vsk3 (npm)
- Aug 14, 2025
Malicious code in volcano-lava-rjw951-project (npm)
- Aug 14, 2025
Malicious code in volcano-kite-kwh318-project (npm)
- Aug 14, 2025
Malicious code in volcano-gorilla-frn664-project (npm)
- Aug 14, 2025
Malicious code in volcano-foxtrot-i31l (npm)
- Aug 14, 2025
Malicious code in volcano-fjord-inl525-project (npm)
- Aug 14, 2025
Malicious code in volcano-fennel-s2pq (npm)
- Aug 14, 2025
Malicious code in volcano-falcon-olm559-project (npm)
- Aug 14, 2025
Malicious code in volcano-butterfly-clt405-project (npm)
- Aug 14, 2025
Malicious code in volcano-boulder-dor911-project (npm)
- Aug 14, 2025
Malicious code in void-slides-farout-pavo (npm)
- Aug 14, 2025
Malicious code in void-rho-load-double-benchmark (npm)
- Aug 14, 2025
Malicious code in void-psi-omicron-signal-abstract (npm)
- Aug 14, 2025
Malicious code in void-perseus-rocket-zenobia (npm)
- Aug 14, 2025
Malicious code in void-omicron-nu-index-await (npm)
- Aug 14, 2025
Malicious code in void-kardashevscale-europa-promise (npm)
- Aug 14, 2025
Malicious code in void-ivy-nxzu (npm)
- Aug 14, 2025
Malicious code in voiceweb (npm)
- Aug 14, 2025
Malicious code in voicepanel-sdk (npm)
- Aug 14, 2025
Malicious code in voicemeeter (npm)
- Aug 14, 2025
Malicious code in voice-quickstart-server-node (npm)
- Aug 14, 2025
Malicious code in vogue-digital-edition (npm)
- Aug 14, 2025
Malicious code in vodbox (npm)
- Aug 14, 2025
Malicious code in vocobo (npm)
- Aug 14, 2025
Malicious code in vocifero (npm)
- Aug 14, 2025
Malicious code in vocablist (npm)
- Aug 14, 2025
Malicious code in vocab-practice-js (npm)
- Aug 14, 2025
Malicious code in vocab-practice (npm)
- Aug 14, 2025
Malicious code in vobrowse (npm)
- Aug 14, 2025
Malicious code in vobin (npm)
- Aug 14, 2025
Malicious code in voacap (npm)
- Aug 14, 2025
Malicious code in vnte2 (npm)
- Aug 14, 2025
Malicious code in vnhkbdjystfwaoqg (npm)
- Aug 14, 2025
Malicious code in vndorm (npm)
- Aug 14, 2025
Malicious code in vma-robot (npm)
- Aug 14, 2025
Malicious code in vma-gojs (npm)
- Aug 14, 2025
Malicious code in vlocate (npm)
- Aug 14, 2025
Malicious code in vlasov (npm)
- Aug 14, 2025
Malicious code in vl-ui-template (npm)
- Aug 14, 2025
Malicious code in vl-ui-grid (npm)
- Aug 14, 2025
Malicious code in vl-ui-footer (npm)
- Aug 14, 2025
Malicious code in vksuite (npm)
- Aug 14, 2025
Malicious code in vkfilter (npm)
- Aug 14, 2025
Malicious code in vk-teams-bridge (npm)
Page 5252 of 6,666