Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,242 total in npm · sorted newest first- Aug 14, 2025
Malicious code in strawberry-charlie-yjxr (npm)
- Aug 14, 2025
Malicious code in strawberry-charlie-nbai (npm)
- Aug 14, 2025
Malicious code in strawberry-bravo-honeydew-lvncg (npm)
- Aug 14, 2025
Malicious code in strawberry-apple-mnnx (npm)
- Aug 14, 2025
Malicious code in strawberry-apple-hptg (npm)
- Aug 14, 2025
Malicious code in strawberry-almond-hqkl (npm)
- Aug 14, 2025
Malicious code in strawberry-91w-project (npm)
- Aug 14, 2025
Malicious code in strawberry-7b9-project (npm)
- Aug 14, 2025
Malicious code in strawberry-74v-project (npm)
- Aug 14, 2025
Malicious code in strawberry-37a-project (npm)
- Aug 14, 2025
Malicious code in strawberry-29r-project (npm)
- Aug 14, 2025
Malicious code in strawberry-1n7-project (npm)
- Aug 14, 2025
Malicious code in stratosphere-nodejs-gatsby-cosmogenic (npm)
- Aug 14, 2025
Malicious code in stratosphere-meteor-testcafe-pulsar (npm)
- Aug 14, 2025
Malicious code in stratosphere-membrane-geochemistry-ethology (npm)
- Aug 14, 2025
Malicious code in stratigraphy-changelog-prettier-stylelint-sqlite (npm)
- Aug 14, 2025
Malicious code in strapi-upload-aws-s3 (npm)
- Aug 14, 2025
Malicious code in storybook-addon-data-roulette (npm)
- Aug 14, 2025
Malicious code in stormxing (npm)
- Aug 14, 2025
Malicious code in stormusa (npm)
- Aug 14, 2025
Malicious code in stormondemand (npm)
- Aug 14, 2025
Malicious code in stormblog (npm)
- Aug 14, 2025
Malicious code in storj-playwright-ui (npm)
- Aug 14, 2025
Malicious code in storiapp (npm)
- Aug 14, 2025
Malicious code in storeidcloud (npm)
- Aug 14, 2025
Malicious code in storeid (npm)
- Aug 14, 2025
Malicious code in storefront-kit-react (npm)
- Aug 14, 2025
Malicious code in storedvalueserv-paypal (npm)
- Aug 14, 2025
Malicious code in storedock (npm)
- Aug 14, 2025
Malicious code in storagefire (npm)
- Aug 14, 2025
Malicious code in stopmotor (npm)
- Aug 14, 2025
Malicious code in stop-vuepress-augmentedreality-dactyl (npm)
- Aug 14, 2025
Malicious code in stop-neutrino-altair-astrobiology (npm)
- Aug 14, 2025
Malicious code in stop-galaxy-commitlint-config-angular-parallax (npm)
- Aug 14, 2025
Malicious code in stolid (npm)
- Aug 14, 2025
Malicious code in stockwatcher (npm)
- Aug 14, 2025
Malicious code in stocatto (npm)
- Aug 14, 2025
Malicious code in stimmapp (npm)
- Aug 14, 2025
Malicious code in stereocam (npm)
- Aug 14, 2025
Malicious code in stepped (npm)
- Aug 14, 2025
Malicious code in stepbatch2023-mylib (npm)
- Aug 14, 2025
Malicious code in steklov (npm)
- Aug 14, 2025
Malicious code in stegogami (npm)
- Aug 14, 2025
Malicious code in stegfs (npm)
- Aug 14, 2025
Malicious code in steganography-superflare-charon-antares (npm)
- Aug 14, 2025
Malicious code in steganography-dactyl-css-loader-radiometric (npm)
- Aug 14, 2025
Malicious code in steganography-astrophysics-pyxis-photon (npm)
- Aug 14, 2025
Malicious code in stedin-ssp (npm)
- Aug 14, 2025
Malicious code in stedin-notes (npm)
- Aug 14, 2025
Malicious code in steamuniversal-api (npm)
Page 5342 of 6,665