Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,281 total in npm · sorted newest first- Aug 14, 2025
Malicious code in user-mgmt (npm)
- Aug 14, 2025
Malicious code in user-authorization (npm)
- Aug 14, 2025
Malicious code in used-first-in-postinstall-script-dotslashed (npm)
- Aug 14, 2025
Malicious code in usecase3 (npm)
- Aug 14, 2025
Malicious code in use-strict-mode (npm)
- Aug 14, 2025
Malicious code in usbcan (npm)
- Aug 14, 2025
Malicious code in usage-tracker-public (npm)
- Aug 14, 2025
Malicious code in urx24g (npm)
- Aug 14, 2025
Malicious code in urt3 (npm)
- Aug 14, 2025
Malicious code in ursa-update-spectron-webdriver-helmet (npm)
- Aug 14, 2025
Malicious code in ursa-run-script-hermes-bulma (npm)
- Aug 14, 2025
Malicious code in ursa-robotics-whitedwarf-envconfig (npm)
- Aug 14, 2025
Malicious code in ursa-perseus-loopback-aldebaran (npm)
- Aug 14, 2025
Malicious code in ursa-jsonp-lyra-dotenv-safe (npm)
- Aug 14, 2025
Malicious code in ursa-global-passport-markdown-pdf (npm)
- Aug 14, 2025
Malicious code in ursa-betelgeuse-commitizen-xanadu (npm)
- Aug 14, 2025
Malicious code in urlpatterngenerator (npm)
- Aug 14, 2025
Malicious code in urlparserjs (npm)
- Aug 14, 2025
Malicious code in urlmod (npm)
- Aug 14, 2025
Malicious code in url.resolve (npm)
- Aug 14, 2025
Malicious code in url-bar-notification-button (npm)
- Aug 14, 2025
Malicious code in urkwebyvaiktxqdc (npm)
- Aug 14, 2025
Malicious code in urelease (npm)
- Aug 14, 2025
Malicious code in uranology-eleventy-vortex-async (npm)
- Aug 14, 2025
Malicious code in uranium-vortex-ooj444-project (npm)
- Aug 14, 2025
Malicious code in uranium-quasar-xnw897-project (npm)
- Aug 14, 2025
Malicious code in uranium-quasar-kuq899-project (npm)
- Aug 14, 2025
Malicious code in uranium-peacock-zvu363-project (npm)
- Aug 14, 2025
Malicious code in uranium-orchid-jdk830-project (npm)
- Aug 14, 2025
Malicious code in uranium-meadow-zlw642-project (npm)
- Aug 14, 2025
Malicious code in uranium-lava-yqw291-project (npm)
- Aug 14, 2025
Malicious code in uranium-labyrinth-ipd496-project (npm)
- Aug 14, 2025
Malicious code in uranium-iguana-yvo876-project (npm)
- Aug 14, 2025
Malicious code in uranium-honey-gdq469-project (npm)
- Aug 14, 2025
Malicious code in uranium-dune-uxp824-project (npm)
- Aug 14, 2025
Malicious code in uranium-desert-lnl212-project (npm)
- Aug 14, 2025
Malicious code in uranium-crystal-qro686-project (npm)
- Aug 14, 2025
Malicious code in uranium-buffalo-lrm365-project (npm)
- Aug 14, 2025
Malicious code in uranium-boulder-gyo516-project (npm)
- Aug 14, 2025
Malicious code in upvjtqewhdkrgkal (npm)
- Aug 14, 2025
Malicious code in uptheante (npm)
- Aug 14, 2025
Malicious code in upsilon-module-info-daemon-process (npm)
- Aug 14, 2025
Malicious code in upsilon-decode-gamma-slow-report (npm)
- Aug 14, 2025
Malicious code in upload_package (npm)
- Aug 14, 2025
Malicious code in upload-to-release (npm)
- Aug 14, 2025
Malicious code in upload-file-to-firebase (npm)
- Aug 14, 2025
Malicious code in uplift-zk0ez-62vgh-xenith-project (npm)
- Aug 14, 2025
Malicious code in uplift-h5yn2-4sfmq-orbit-project (npm)
- Aug 14, 2025
Malicious code in uplift-gz0px-3j26r-horizon-project (npm)
- Aug 14, 2025
Malicious code in uplift-buir7-pig4r-hearth-project (npm)
Page 5264 of 6,666