Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,281 total in npm · sorted newest first- Aug 14, 2025
Malicious code in transport-hermes-biomimicry-webdriver-manager (npm)
- Aug 14, 2025
Malicious code in transport-cluster-grunt-phoenix (npm)
- Aug 14, 2025
Malicious code in transport-antimatter-configstore-transhumanism (npm)
- Aug 14, 2025
Malicious code in transleet (npm)
- Aug 14, 2025
Malicious code in translations-kiwi (npm)
- Aug 14, 2025
Malicious code in translation_locale_yml_updater (npm)
- Aug 14, 2025
Malicious code in transhumanism-pyxis-astroinformatics-charon (npm)
- Aug 14, 2025
Malicious code in transhumanism-prompts-paleobotany-canopus (npm)
- Aug 14, 2025
Malicious code in transform-prompts-dynamo-astrometry (npm)
- Aug 14, 2025
Malicious code in transform-markdownlint-ethology-cypress (npm)
- Aug 14, 2025
Malicious code in transelot (npm)
- Aug 14, 2025
Malicious code in transdraw (npm)
- Aug 14, 2025
Malicious code in transcrypto (npm)
- Aug 14, 2025
Malicious code in transcogg (npm)
- Aug 14, 2025
Malicious code in tranquil-z8e7k-5t7m0-drift-project (npm)
- Aug 14, 2025
Malicious code in tranquil-wzom9-ggeak-zen-project (npm)
- Aug 14, 2025
Malicious code in tranquil-vgsk6-mexpa-willow-project (npm)
- Aug 14, 2025
Malicious code in tranquil-sp3vo-oe9v9-knoll-project (npm)
- Aug 14, 2025
Malicious code in tranquil-lmoh3-2q7j7-ice-project (npm)
- Aug 14, 2025
Malicious code in tranquil-im01m-sfa8k-mystic-project (npm)
- Aug 14, 2025
Malicious code in tranquil-icejo-vynb2-ember-project (npm)
- Aug 14, 2025
Malicious code in tranquil-7gvja-sihpf-gale-project (npm)
- Aug 14, 2025
Malicious code in tranquil-36orr-923lv-echo-project (npm)
- Aug 14, 2025
Malicious code in trango (npm)
- Aug 14, 2025
Malicious code in tramqp (npm)
- Aug 14, 2025
Malicious code in traktical (npm)
- Aug 14, 2025
Malicious code in trainui (npm)
- Aug 14, 2025
Malicious code in trainapi (npm)
- Aug 14, 2025
Malicious code in traider (npm)
- Aug 14, 2025
Malicious code in trafmon (npm)
- Aug 14, 2025
Malicious code in traducir (npm)
- Aug 14, 2025
Malicious code in tradies (npm)
- Aug 14, 2025
Malicious code in tradicni (npm)
- Aug 14, 2025
Malicious code in traders-platform-library (npm)
- Aug 14, 2025
Malicious code in trademc (npm)
- Aug 14, 2025
Malicious code in tracksim (npm)
- Aug 14, 2025
Malicious code in traceur_test_module (npm)
- Aug 14, 2025
Malicious code in traceray (npm)
- Aug 14, 2025
Malicious code in traceid (npm)
- Aug 14, 2025
Malicious code in trace-log-builder (npm)
- Aug 14, 2025
Malicious code in tqsbeaigklrdphfn (npm)
- Aug 14, 2025
Malicious code in tpwjgfirhlekodkb (npm)
- Aug 14, 2025
Malicious code in tpsysteme (npm)
- Aug 14, 2025
Malicious code in tpl-browser (npm)
- Aug 14, 2025
Malicious code in tpkmean (npm)
- Aug 14, 2025
Malicious code in tpidqghklrmuoxna (npm)
- Aug 14, 2025
Malicious code in tpcexzlfrwiyuqmj (npm)
- Aug 14, 2025
Malicious code in toyparser (npm)
- Aug 14, 2025
Malicious code in toymwjuidplxzvkb (npm)
- Aug 14, 2025
Malicious code in toyint (npm)
Page 5280 of 6,666