Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,242 total in npm · sorted newest first- Aug 14, 2025
Malicious code in stylelint-polaris (npm)
- Aug 14, 2025
Malicious code in stylelint-function-url-no-domain (npm)
- Aug 14, 2025
Malicious code in stylelint-config-toolbox (npm)
- Aug 14, 2025
Malicious code in stylelint-config-edx (npm)
- Aug 14, 2025
Malicious code in stylelint-config-data-ui (npm)
- Aug 14, 2025
Malicious code in styled-jsx-plugin-sass-2 (npm)
- Aug 14, 2025
Malicious code in style-loader-spectroscopy-nova-browserify (npm)
- Aug 14, 2025
Malicious code in style-loader-server-epimetheus-dotenv-safe (npm)
- Aug 14, 2025
Malicious code in style-loader-nextjs-css-loader-gemini (npm)
- Aug 14, 2025
Malicious code in style-loader-link-umbriel-wasat (npm)
- Aug 14, 2025
Malicious code in style-loader-elara-protractor-csrf (npm)
- Aug 14, 2025
Malicious code in style-loader-bellatrix-registry-alphard (npm)
- Aug 14, 2025
Malicious code in style-format (npm)
- Aug 14, 2025
Malicious code in style-dom (npm)
- Aug 14, 2025
Malicious code in style-console (npm)
- Aug 14, 2025
Malicious code in stuxnet (npm)
- Aug 14, 2025
Malicious code in stutters (npm)
- Aug 14, 2025
Malicious code in stukdonew (npm)
- Aug 14, 2025
Malicious code in studyflip (npm)
- Aug 14, 2025
Malicious code in studo-services (npm)
- Aug 14, 2025
Malicious code in studgod (npm)
- Aug 14, 2025
Malicious code in student-competition (npm)
- Aug 14, 2025
Malicious code in stub-cat-good-quick-sigma (npm)
- Aug 14, 2025
Malicious code in stub-alpha-sed-transpile-cold (npm)
- Aug 14, 2025
Malicious code in struktor (npm)
- Aug 14, 2025
Malicious code in structured-event-logger (npm)
- Aug 14, 2025
Malicious code in structure-page-kitchen (npm)
- Aug 14, 2025
Malicious code in strssapp (npm)
- Aug 14, 2025
Malicious code in stringsx (npm)
- Aug 14, 2025
Malicious code in string-tethys-eleventy-astroinformatics (npm)
- Aug 14, 2025
Malicious code in string-template-extractor (npm)
- Aug 14, 2025
Malicious code in string-neuromorphic-ursa-alphard (npm)
- Aug 14, 2025
Malicious code in string-magnetosphere-webdriver-mocha-uglify-js (npm)
- Aug 14, 2025
Malicious code in string-letter-bee (npm)
- Aug 14, 2025
Malicious code in string-book-char-protected-deploy (npm)
- Aug 14, 2025
Malicious code in string-await-bad-uglify-small (npm)
- Aug 14, 2025
Malicious code in strictor (npm)
- Aug 14, 2025
Malicious code in stricto-helper (npm)
- Aug 14, 2025
Malicious code in strict-null-check-migration-tools (npm)
- Aug 14, 2025
Malicious code in striation (npm)
- Aug 14, 2025
Malicious code in streamrec (npm)
- Aug 14, 2025
Malicious code in streammebot (npm)
- Aug 14, 2025
Malicious code in streaming-grid (npm)
- Aug 14, 2025
Malicious code in streambox-client (npm)
- Aug 14, 2025
Malicious code in stream-weywot-postcss-loader-version (npm)
- Aug 14, 2025
Malicious code in stream-uglify-js-aldebaran-framework (npm)
- Aug 14, 2025
Malicious code in stream-polaris-andromeda-cz-conventional-changelog (npm)
- Aug 14, 2025
Malicious code in stream-manager (npm)
- Aug 14, 2025
Malicious code in stream-format (npm)
- Aug 14, 2025
Malicious code in stream-fermiparadox-scripts-update (npm)
Page 5340 of 6,665