Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,242 total in npm · sorted newest first- Aug 14, 2025
Malicious code in taggr (npm)
- Aug 14, 2025
Malicious code in tag-middleware (npm)
- Aug 14, 2025
Malicious code in taffydocs (npm)
- Aug 14, 2025
Malicious code in taekbae (npm)
- Aug 14, 2025
Malicious code in tad-icons (npm)
- Aug 14, 2025
Malicious code in tacoland (npm)
- Aug 14, 2025
Malicious code in tacktech (npm)
- Aug 14, 2025
Malicious code in tachyon-style-loader-sadr-hapi (npm)
- Aug 14, 2025
Malicious code in tabufi (npm)
- Aug 14, 2025
Malicious code in tabmark (npm)
- Aug 14, 2025
Malicious code in tablogo (npm)
- Aug 14, 2025
Malicious code in tablekit (npm)
- Aug 14, 2025
Malicious code in tableau_ruby (npm)
- Aug 14, 2025
Malicious code in table-query (npm)
- Aug 14, 2025
Malicious code in table-awk-epsilon-unix-route (npm)
- Aug 14, 2025
Malicious code in tablator (npm)
- Aug 14, 2025
Malicious code in tabisapo (npm)
- Aug 14, 2025
Malicious code in tabcmd (npm)
- Aug 14, 2025
Malicious code in taalame (npm)
- Aug 14, 2025
Malicious code in taachain (npm)
- Aug 14, 2025
Malicious code in t7rkow (npm)
- Aug 14, 2025
Malicious code in t5.admin (npm)
- Aug 14, 2025
Malicious code in t2c-web-admin (npm)
- Aug 14, 2025
Malicious code in syw-uikit (npm)
- Aug 14, 2025
Malicious code in sytheve (npm)
- Aug 14, 2025
Malicious code in systick (npm)
- Aug 14, 2025
Malicious code in systemd-watchdog-notify (npm)
- Aug 14, 2025
Malicious code in system-modeling (npm)
- Aug 14, 2025
Malicious code in sysr (npm)
- Aug 14, 2025
Malicious code in sysmap (npm)
- Aug 14, 2025
Malicious code in syscpar (npm)
- Aug 14, 2025
Malicious code in syscod (npm)
- Aug 14, 2025
Malicious code in syokinet (npm)
- Aug 14, 2025
Malicious code in synthetic-vegito-database (npm)
- Aug 14, 2025
Malicious code in synthetic-rqzax-database (npm)
- Aug 14, 2025
Malicious code in synthetic-horizon-database (npm)
- Aug 14, 2025
Malicious code in synthetic-deku (npm)
- Aug 14, 2025
Malicious code in syngenio_licensecheck (npm)
- Aug 14, 2025
Malicious code in synerj (npm)
- Aug 14, 2025
Malicious code in syncsub (npm)
- Aug 14, 2025
Malicious code in syncinfo (npm)
- Aug 14, 2025
Malicious code in synced-plus-agent (npm)
- Aug 14, 2025
Malicious code in synccft (npm)
- Aug 14, 2025
Malicious code in sync-yaml-command-ganymede (npm)
- Aug 14, 2025
Malicious code in sync-superagent-forever-singularitarianism (npm)
- Aug 14, 2025
Malicious code in sync-subscription-foundation-procyon (npm)
- Aug 14, 2025
Malicious code in sync-sampled-reviews-with-raw-reviews (npm)
- Aug 14, 2025
Malicious code in sync-color (npm)
- Aug 14, 2025
Malicious code in sync-chalk-cygnus-arcturus (npm)
- Aug 14, 2025
Malicious code in sync-astrochemistry-lithosphere-cordelia (npm)
Page 5335 of 6,665