Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,242 total in npm · sorted newest first- Aug 14, 2025
Malicious code in synbad (npm)
- Aug 14, 2025
Malicious code in symnrt (npm)
- Aug 14, 2025
Malicious code in symfonyc (npm)
- Aug 14, 2025
Malicious code in symbol-fstring (npm)
- Aug 14, 2025
Malicious code in symbcs (npm)
- Aug 14, 2025
Malicious code in sym-responsive (npm)
- Aug 14, 2025
Malicious code in syllabi (npm)
- Aug 14, 2025
Malicious code in sylabs (npm)
- Aug 14, 2025
Malicious code in sygerea (npm)
- Aug 14, 2025
Malicious code in sydcms (npm)
- Aug 14, 2025
Malicious code in sycamore-platform-components (npm)
- Aug 14, 2025
Malicious code in sycamore-platform (npm)
- Aug 14, 2025
Malicious code in sycamore-integration-postcodeanywhere (npm)
- Aug 14, 2025
Malicious code in sycamore-integration-mandrill (npm)
- Aug 14, 2025
Malicious code in sycamore-integration-kashflow (npm)
- Aug 14, 2025
Malicious code in sycamore-integration-freeagent (npm)
- Aug 14, 2025
Malicious code in sycamore-integration-evolution (npm)
- Aug 14, 2025
Malicious code in sycamore-integration-carweb (npm)
- Aug 14, 2025
Malicious code in sycamore-integration-bravolink (npm)
- Aug 14, 2025
Malicious code in sycamore-integration-basecamp (npm)
- Aug 14, 2025
Malicious code in sycamore-integration-algolia (npm)
- Aug 14, 2025
Malicious code in sycamore-erp (npm)
- Aug 14, 2025
Malicious code in sycamore-crm (npm)
- Aug 14, 2025
Malicious code in syarobot (npm)
- Aug 14, 2025
Malicious code in sxbznqp (npm)
- Aug 14, 2025
Malicious code in swxzmflbqpcythgv (npm)
- Aug 14, 2025
Malicious code in swrepo (npm)
- Aug 14, 2025
Malicious code in sworkit-workouts (npm)
- Aug 14, 2025
Malicious code in swokhgqmebtcpjir (npm)
- Aug 14, 2025
Malicious code in switcharoo-plugin-metrics (npm)
- Aug 14, 2025
Malicious code in switcharoo-plugin-ads (npm)
- Aug 14, 2025
Malicious code in switcharoo (npm)
- Aug 14, 2025
Malicious code in swiss-army-knife (npm)
- Aug 14, 2025
Malicious code in swishper (npm)
- Aug 14, 2025
Malicious code in swipable (npm)
- Aug 14, 2025
Malicious code in swinhoii (npm)
- Aug 14, 2025
Malicious code in swiftpdf (npm)
- Aug 14, 2025
Malicious code in swiftbits (npm)
- Aug 14, 2025
Malicious code in swift-search (npm)
- Aug 14, 2025
Malicious code in swift-playground-builder (npm)
1 compromised version
- Aug 14, 2025
Malicious code in swicks (npm)
- Aug 14, 2025
Malicious code in swfpoc (npm)
- Aug 14, 2025
Malicious code in swexikcykpgrtqud (npm)
- Aug 14, 2025
Malicious code in swembl (npm)
- Aug 14, 2025
Malicious code in swarmcube (npm)
- Aug 14, 2025
Malicious code in swaptrack (npm)
- Aug 14, 2025
Malicious code in swap_middleware (npm)
- Aug 14, 2025
Malicious code in swan-yucca-iir777-project (npm)
- Aug 14, 2025
Malicious code in swan-xenon-qnv320-project (npm)
- Aug 14, 2025
Malicious code in swan-vulture-djn616-project (npm)
Page 5336 of 6,665