Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,242 total in npm · sorted newest first- Aug 14, 2025
Malicious code in star-emerald-gwd610-project (npm)
- Aug 14, 2025
Malicious code in star-elephant-ikk119-project (npm)
- Aug 14, 2025
Malicious code in star-dove-bvm021-project (npm)
- Aug 14, 2025
Malicious code in star-dewdrop-zce411-project (npm)
- Aug 14, 2025
Malicious code in star-cold-sudo-encrypt-void (npm)
- Aug 14, 2025
Malicious code in star-cat-fmn497-project (npm)
- Aug 14, 2025
Malicious code in star-blossom-fex500-project (npm)
- Aug 14, 2025
Malicious code in star-awk-interface-final-psi (npm)
- Aug 14, 2025
Malicious code in star-arctic-jnt261-project (npm)
- Aug 14, 2025
Malicious code in star-abstract-epsilon-log-pipe (npm)
- Aug 14, 2025
Malicious code in star-08q34-uf2ar-pinnacle-project (npm)
- Aug 14, 2025
Malicious code in standardwebappwebwebwebwebwebwebwebweb (npm)
- Aug 14, 2025
Malicious code in standardwebappwebwebwebwebwebwebweb (npm)
- Aug 14, 2025
Malicious code in standardwebappwebwebwebwebwebweb (npm)
- Aug 14, 2025
Malicious code in standardwebappwebwebwebwebweb (npm)
- Aug 14, 2025
Malicious code in standardwebappwebwebwebweb (npm)
- Aug 14, 2025
Malicious code in standardwebappwebwebweb (npm)
- Aug 14, 2025
Malicious code in standardwebappwebweb (npm)
- Aug 14, 2025
Malicious code in standardwebappweb (npm)
- Aug 14, 2025
Malicious code in standardwebapp (npm)
- Aug 14, 2025
Malicious code in standardweb8888 (npm)
- Aug 14, 2025
Malicious code in standardweb88 (npm)
- Aug 14, 2025
Malicious code in standardweb4 (npm)
- Aug 14, 2025
Malicious code in standardweb2 (npm)
- Aug 14, 2025
Malicious code in standardweb1 (npm)
- Aug 14, 2025
Malicious code in standard888888 (npm)
- Aug 14, 2025
Malicious code in standard888874 (npm)
- Aug 14, 2025
Malicious code in standard8888 (npm)
- Aug 14, 2025
Malicious code in standard8874 (npm)
- Aug 14, 2025
Malicious code in standard88 (npm)
- Aug 14, 2025
Malicious code in standard-with-typescript (npm)
- Aug 14, 2025
Malicious code in standard-sociobiology-brane-xenon (npm)
- Aug 14, 2025
Malicious code in standard-rehype-cosmiconfig-subscription (npm)
- Aug 14, 2025
Malicious code in standard-babel-lynx-loop (npm)
- Aug 14, 2025
Malicious code in standard-abiogenesis-terser-procyon (npm)
- Aug 14, 2025
Malicious code in stampibox (npm)
- Aug 14, 2025
Malicious code in stagemine (npm)
- Aug 14, 2025
Malicious code in stack-sun-void-tau-water (npm)
- Aug 14, 2025
Malicious code in stack-balance-cloud-function-zeta (npm)
- Aug 14, 2025
Malicious code in stacis (npm)
- Aug 14, 2025
Malicious code in stabilizer (npm)
- Aug 14, 2025
Malicious code in ssucss (npm)
- Aug 14, 2025
Malicious code in ssr-frontend (npm)
1 compromised version
- Aug 14, 2025
Malicious code in ssqget (npm)
- Aug 14, 2025
Malicious code in sso-paypal (npm)
- Aug 14, 2025
Malicious code in sso (npm)
- Aug 14, 2025
Malicious code in ssmith (npm)
- Aug 14, 2025
Malicious code in ssllabs (npm)
- Aug 14, 2025
Malicious code in sslinux (npm)
- Aug 14, 2025
Malicious code in sslgem (npm)
Page 5344 of 6,665