Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,242 total in npm · sorted newest first- Aug 14, 2025
Malicious code in spruce-reef-ayo753-project (npm)
- Aug 14, 2025
Malicious code in spruce-papaya-wpyl (npm)
- Aug 14, 2025
Malicious code in spruce-opal-kvp558-project (npm)
- Aug 14, 2025
Malicious code in spruce-nugget-vlu174-project (npm)
- Aug 14, 2025
Malicious code in spruce-lagoon-lvf632-project (npm)
- Aug 14, 2025
Malicious code in spruce-lagoon-lqf913-project (npm)
- Aug 14, 2025
Malicious code in spruce-infinity-qym565-project (npm)
- Aug 14, 2025
Malicious code in spruce-inferno-nwlu (npm)
- Aug 14, 2025
Malicious code in spruce-icicle-dod907-project (npm)
- Aug 14, 2025
Malicious code in spruce-hollow-ahw924-project (npm)
- Aug 14, 2025
Malicious code in spruce-hill-gxm423-project (npm)
- Aug 14, 2025
Malicious code in spruce-glacier-hrx832-project (npm)
- Aug 14, 2025
Malicious code in spruce-fennel-n8s7 (npm)
- Aug 14, 2025
Malicious code in spruce-falcon-ylk807-project (npm)
- Aug 14, 2025
Malicious code in spruce-dolphin-rhf664-project (npm)
- Aug 14, 2025
Malicious code in spruce-blackhole-g983 (npm)
- Aug 14, 2025
Malicious code in spruce-bamboo-hoe982-project (npm)
- Aug 14, 2025
Malicious code in sprrepo (npm)
- Aug 14, 2025
Malicious code in sprout-wcm-service (npm)
- Aug 14, 2025
Malicious code in spritopia (npm)
- Aug 14, 2025
Malicious code in sprinx-crm-ui-activity (npm)
- Aug 14, 2025
Malicious code in springxj (npm)
- Aug 14, 2025
Malicious code in springpad (npm)
- Aug 14, 2025
Malicious code in spreebee (npm)
- Aug 14, 2025
Malicious code in sprace (npm)
- Aug 14, 2025
Malicious code in spotshot (npm)
- Aug 14, 2025
Malicious code in spotping (npm)
- Aug 14, 2025
Malicious code in spotish (npm)
- Aug 14, 2025
Malicious code in spotify-talos (npm)
- Aug 14, 2025
Malicious code in spotify-heroic-datasource (npm)
- Aug 14, 2025
Malicious code in spotify-apollo-oss-site (npm)
- Aug 14, 2025
Malicious code in spotibye (npm)
- Aug 14, 2025
Malicious code in spotbook (npm)
- Aug 14, 2025
Malicious code in sportstream-widgets (npm)
- Aug 14, 2025
Malicious code in sportscup (npm)
- Aug 14, 2025
Malicious code in sporest (npm)
- Aug 14, 2025
Malicious code in spoonx (npm)
- Aug 14, 2025
Malicious code in spoom (npm)
- Aug 14, 2025
Malicious code in spookyjs (npm)
- Aug 14, 2025
Malicious code in spojcodes (npm)
- Aug 14, 2025
Malicious code in spodelime (npm)
- Aug 14, 2025
Malicious code in spocktest (npm)
- Aug 14, 2025
Malicious code in splunk_formatter (npm)
- Aug 14, 2025
Malicious code in splocator (npm)
- Aug 14, 2025
Malicious code in splncs (npm)
- Aug 14, 2025
Malicious code in splitop (npm)
- Aug 14, 2025
Malicious code in splitit (npm)
- Aug 14, 2025
Malicious code in splitio (npm)
- Aug 14, 2025
Malicious code in splitable (npm)
- Aug 14, 2025
Malicious code in split-file-events (npm)
Page 5346 of 6,665