Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,281 total in npm · sorted newest first- Aug 14, 2025
Malicious code in tsukuba (npm)
- Aug 14, 2025
Malicious code in tsudoi (npm)
- Aug 14, 2025
Malicious code in tssplit (npm)
- Aug 14, 2025
Malicious code in tsphdvckrgqezibw (npm)
- Aug 14, 2025
Malicious code in tslyrics (npm)
- Aug 14, 2025
Malicious code in tslint-config-toolbox (npm)
- Aug 14, 2025
Malicious code in tslint-config-rtl (npm)
- Aug 14, 2025
Malicious code in tslint-config-baseline (npm)
- Aug 14, 2025
Malicious code in tsktsk (npm)
- Aug 14, 2025
Malicious code in tsclust (npm)
- Aug 14, 2025
Malicious code in tsbapp (npm)
- Aug 14, 2025
Malicious code in tsb-proteo-ui-basics (npm)
- Aug 14, 2025
Malicious code in ts2c-target-gbdk-n (npm)
- Aug 14, 2025
Malicious code in ts2c-target-arduino (npm)
- Aug 14, 2025
Malicious code in ts-petstore-client (npm)
- Aug 14, 2025
Malicious code in ts-objectschema (npm)
- Aug 14, 2025
Malicious code in ts-npm (npm)
- Aug 14, 2025
Malicious code in ts-interface-loader-example (npm)
- Aug 14, 2025
Malicious code in trytyr (npm)
- Aug 14, 2025
Malicious code in tryingsomethingnewonnpm (npm)
- Aug 14, 2025
Malicious code in try-void-sandbox-sanitize-emulate (npm)
- Aug 14, 2025
Malicious code in try-test-cluster-eta-enum (npm)
- Aug 14, 2025
Malicious code in try-refactor-yaml-decompress-phi (npm)
- Aug 14, 2025
Malicious code in try-meta-error-water-cat (npm)
- Aug 14, 2025
Malicious code in try-catch-core-2 (npm)
- Aug 14, 2025
Malicious code in trustehr (npm)
- Aug 14, 2025
Malicious code in truncate-html-lth (npm)
- Aug 14, 2025
Malicious code in trufflehogz (npm)
- Aug 14, 2025
Malicious code in truffledev (npm)
- Aug 14, 2025
Malicious code in trufflebuildlog (npm)
- Aug 14, 2025
Malicious code in truffle-v99 (npm)
- Aug 14, 2025
Malicious code in truffle-v5 (npm)
- Aug 14, 2025
Malicious code in truffle-plugin-blockscout-verify-jordin (npm)
- Aug 14, 2025
Malicious code in truelevel (npm)
- Aug 14, 2025
Malicious code in trucks-cli (npm)
- Aug 14, 2025
Malicious code in truckload (npm)
- Aug 14, 2025
Malicious code in troskovi (npm)
- Aug 14, 2025
Malicious code in troposphere-run-script-geochronology-neutrino (npm)
- Aug 14, 2025
Malicious code in troposphere-pegasus-centauri-supervisor (npm)
- Aug 14, 2025
Malicious code in troposphere-centauri-algol-technocracy (npm)
- Aug 14, 2025
Malicious code in tropicons (npm)
- Aug 14, 2025
Malicious code in tropical-example-web-app (npm)
- Aug 14, 2025
Malicious code in trophyjs (npm)
- Aug 14, 2025
Malicious code in tromolo (npm)
- Aug 14, 2025
Malicious code in tromke (npm)
- Aug 14, 2025
Malicious code in trollshell (npm)
- Aug 14, 2025
Malicious code in trk-logger (npm)
- Aug 14, 2025
Malicious code in tritree (npm)
- Aug 14, 2025
Malicious code in triton-rollup-plugin-cz-conventional-changelog-sqlite (npm)
- Aug 14, 2025
Malicious code in triton-readable-luna-farout (npm)
Page 5278 of 6,666