Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,281 total in npm · sorted newest first- Aug 14, 2025
Malicious code in valley-piano-xhz990-project (npm)
- Aug 14, 2025
Malicious code in valley-peacock-hfj472-project (npm)
- Aug 14, 2025
Malicious code in valley-octopus-cip450-project (npm)
- Aug 14, 2025
Malicious code in valley-nocturne-dsy318-project (npm)
- Aug 14, 2025
Malicious code in valley-meadow-lle458-project (npm)
- Aug 14, 2025
Malicious code in valley-kiwi-vhl510-project (npm)
- Aug 14, 2025
Malicious code in valley-kite-bun380-project (npm)
- Aug 14, 2025
Malicious code in valley-kelp-yni601-project (npm)
- Aug 14, 2025
Malicious code in valley-harbor-xfp990-project (npm)
- Aug 14, 2025
Malicious code in valley-glacier-gtd322-project (npm)
- Aug 14, 2025
Malicious code in valley-forest-qyj349-project (npm)
- Aug 14, 2025
Malicious code in valley-everglow-kpd208-project (npm)
- Aug 14, 2025
Malicious code in valley-cfhde-53j77-wave-project (npm)
- Aug 14, 2025
Malicious code in valley-butterfly-prm958-project (npm)
- Aug 14, 2025
Malicious code in valley-82wst-mimv6-xenith-project (npm)
- Aug 14, 2025
Malicious code in validate-function-parse-execute-interface (npm)
- Aug 14, 2025
Malicious code in validate-air-cron-zero-moon (npm)
- Aug 14, 2025
Malicious code in validate-address (npm)
- Aug 14, 2025
Malicious code in valhimpufbcknryx (npm)
- Aug 14, 2025
Malicious code in valforce (npm)
- Aug 14, 2025
Malicious code in valahorn (npm)
- Aug 14, 2025
Malicious code in vaildator (npm)
4 compromised versions
- Aug 14, 2025
Malicious code in v4we3 (npm)
- Aug 14, 2025
Malicious code in v4b24 (npm)
- Aug 14, 2025
Malicious code in v4a3 (npm)
- Aug 14, 2025
Malicious code in v01form-theme-antd (npm)
- Aug 14, 2025
Malicious code in uzqpmrbhwvkxaicn (npm)
- Aug 14, 2025
Malicious code in uzenhcliokptswry (npm)
- Aug 14, 2025
Malicious code in uzdevumi (npm)
- Aug 14, 2025
Malicious code in uytisb (npm)
- Aug 14, 2025
Malicious code in uyqqad (npm)
- Aug 14, 2025
Malicious code in uyogfphjxwrqlmns (npm)
- Aug 14, 2025
Malicious code in uynkahlogqxbstfr (npm)
- Aug 14, 2025
Malicious code in uxutils (npm)
- Aug 14, 2025
Malicious code in uxline (npm)
- Aug 14, 2025
Malicious code in uxjlyfgoarkmpkhd (npm)
- Aug 14, 2025
Malicious code in uxindex.cms.service (npm)
- Aug 14, 2025
Malicious code in uxcamreactexample-typescript (npm)
- Aug 14, 2025
Malicious code in uxc-ng2-services (npm)
- Aug 14, 2025
Malicious code in uxc-ng2-csom (npm)
- Aug 14, 2025
Malicious code in ux1-ui-kit (npm)
- Aug 14, 2025
Malicious code in ux1-framework (npm)
- Aug 14, 2025
Malicious code in ux-styleguide (npm)
- Aug 14, 2025
Malicious code in ux-core-styles (npm)
- Aug 14, 2025
Malicious code in ux-aspects (npm)
- Aug 14, 2025
Malicious code in ux-angular-styleguide (npm)
- Aug 14, 2025
Malicious code in uwwfrdhkiklr3atusrdwbc6rokvcg9gp (npm)
- Aug 14, 2025
Malicious code in uwslis (npm)
- Aug 14, 2025
Malicious code in uws-trashme-after-121-merge (npm)
- Aug 14, 2025
Malicious code in uwhpsc (npm)
Page 5262 of 6,666