Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,281 total in npm · sorted newest first- Aug 14, 2025
Malicious code in thunder-quasar-pfx038-project (npm)
- Aug 14, 2025
Malicious code in thunder-quail-ijh630-project (npm)
- Aug 14, 2025
Malicious code in thunder-nocturne-dtq065-project (npm)
- Aug 14, 2025
Malicious code in thunder-nectar-znj802-project (npm)
- Aug 14, 2025
Malicious code in thunder-nectar-eoj415-project (npm)
- Aug 14, 2025
Malicious code in thunder-kqc8w-0cwf8-coral-project (npm)
- Aug 14, 2025
Malicious code in thunder-koala-kis046-project (npm)
- Aug 14, 2025
Malicious code in thunder-kiwi-fci332-project (npm)
- Aug 14, 2025
Malicious code in thunder-kelp-hvt022-project (npm)
- Aug 14, 2025
Malicious code in thunder-jewel-yoq026-project (npm)
- Aug 14, 2025
Malicious code in thunder-iris-jur448-project (npm)
- Aug 14, 2025
Malicious code in thunder-honeycomb-gkr919-project (npm)
- Aug 14, 2025
Malicious code in thunder-grove-lgp975-project (npm)
- Aug 14, 2025
Malicious code in thunder-g9dfy-ny5bf-rose-project (npm)
- Aug 14, 2025
Malicious code in thunder-evergreen-ceb956-project (npm)
- Aug 14, 2025
Malicious code in thunder-desert-gxv089-project (npm)
- Aug 14, 2025
Malicious code in thunder-b131w-hp6vs-ocean-project (npm)
- Aug 14, 2025
Malicious code in thuban-yonder-process-singularity (npm)
- Aug 14, 2025
Malicious code in thuban-spectron-passport-hapi (npm)
- Aug 14, 2025
Malicious code in thuban-dactyl-nebula-graphql (npm)
- Aug 14, 2025
Malicious code in throne-fygmp-z9csb-celestial-project (npm)
- Aug 14, 2025
Malicious code in throne-a2176-gbuoq-xanadu-project (npm)
- Aug 14, 2025
Malicious code in thrive-amber-mkm632-project (npm)
- Aug 14, 2025
Malicious code in threw2 (npm)
- Aug 14, 2025
Malicious code in threeviz (npm)
- Aug 14, 2025
Malicious code in threequel (npm)
- Aug 14, 2025
Malicious code in threema-desktop (npm)
- Aug 14, 2025
Malicious code in three-editor-release (npm)
- Aug 14, 2025
Malicious code in threaddump-analyzer (npm)
- Aug 14, 2025
Malicious code in thread-reject-runtime-quick-rain (npm)
- Aug 14, 2025
Malicious code in thread-await-function-runtime-balance (npm)
- Aug 14, 2025
Malicious code in thrbjomyugsvekiw (npm)
- Aug 14, 2025
Malicious code in thovcmrzelgwsxyi (npm)
- Aug 14, 2025
Malicious code in thoughtful_migrations (npm)
- Aug 14, 2025
Malicious code in thorodata (npm)
- Aug 14, 2025
Malicious code in thistle-zodiac-gfu867-project (npm)
- Aug 14, 2025
Malicious code in thistle-zebra-afs567-project (npm)
- Aug 14, 2025
Malicious code in thistle-yonder-zej884-project (npm)
- Aug 14, 2025
Malicious code in thistle-topaz-hjc311-project (npm)
- Aug 14, 2025
Malicious code in thistle-peony-jqv821-project (npm)
- Aug 14, 2025
Malicious code in thistle-labyrinth-enw098-project (npm)
- Aug 14, 2025
Malicious code in thistle-koala-zhb885-project (npm)
- Aug 14, 2025
Malicious code in thistle-infinity-eah976-project (npm)
- Aug 14, 2025
Malicious code in thistle-frost-pgq996-project (npm)
- Aug 14, 2025
Malicious code in thistle-dewdrop-myw796-project (npm)
- Aug 14, 2025
Malicious code in thisisclearlysomekindoftestright2 (npm)
- Aug 14, 2025
Malicious code in thisisclearlysomekindoftestright (npm)
- Aug 14, 2025
Malicious code in this-trade-value (npm)
- Aug 14, 2025
Malicious code in thirdone (npm)
- Aug 14, 2025
Malicious code in thirdgame (npm)
Page 5286 of 6,666