Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,242 total in npm · sorted newest first- Aug 14, 2025
Malicious code in spitshine (npm)
- Aug 14, 2025
Malicious code in spitbomb (npm)
- Aug 14, 2025
Malicious code in spirittimers (npm)
- Aug 14, 2025
Malicious code in spirittests (npm)
- Aug 14, 2025
Malicious code in spirittemplate (npm)
- Aug 14, 2025
Malicious code in spiritssl (npm)
- Aug 14, 2025
Malicious code in spiritrscandir (npm)
- Aug 14, 2025
Malicious code in spiritroutes (npm)
- Aug 14, 2025
Malicious code in spiritproxy (npm)
- Aug 14, 2025
Malicious code in spiritnode (npm)
- Aug 14, 2025
Malicious code in spiritmailer (npm)
- Aug 14, 2025
Malicious code in spiritjsdoc (npm)
- Aug 14, 2025
Malicious code in spiritfiles (npm)
- Aug 14, 2025
Malicious code in spiritdependencies (npm)
- Aug 14, 2025
Malicious code in spiritcore (npm)
- Aug 14, 2025
Malicious code in spiritconsole (npm)
- Aug 14, 2025
Malicious code in spiritconfigs (npm)
- Aug 14, 2025
Malicious code in spiritbots (npm)
- Aug 14, 2025
Malicious code in spiral-connectservice (npm)
- Aug 14, 2025
Malicious code in spiral-betservices (npm)
- Aug 14, 2025
Malicious code in spipad (npm)
- Aug 14, 2025
Malicious code in spinsv (npm)
- Aug 14, 2025
Malicious code in spinoff (npm)
- Aug 14, 2025
Malicious code in spinner-neptunology-selenology-cosmology (npm)
- Aug 14, 2025
Malicious code in spinmaker (npm)
- Aug 14, 2025
Malicious code in spinit (npm)
- Aug 14, 2025
Malicious code in spinattic (npm)
- Aug 14, 2025
Malicious code in spinach-pulsar-mttw (npm)
- Aug 14, 2025
Malicious code in spinach-ocean-dxkt (npm)
- Aug 14, 2025
Malicious code in spinach-mike-mw0v (npm)
- Aug 14, 2025
Malicious code in spinach-kuiper-3ojs (npm)
- Aug 14, 2025
Malicious code in spin-web (npm)
- Aug 14, 2025
Malicious code in spicher (npm)
- Aug 14, 2025
Malicious code in spicedham (npm)
- Aug 14, 2025
Malicious code in spica-remark-prompts-phoenix (npm)
- Aug 14, 2025
Malicious code in spica-heka-fetch-quasar (npm)
- Aug 14, 2025
Malicious code in spica-figures-tool-kardashevscale (npm)
- Aug 14, 2025
Malicious code in spica-commitlint-tailwindcss-terser-webpack-plugin (npm)
- Aug 14, 2025
Malicious code in sphnix (npm)
- Aug 14, 2025
Malicious code in spell-check-test (npm)
- MAL-2025-33737Malwarenpmspeleology-puppeteer-optimize-css-assets-webpack-plugin-prettier-plugin-markdownAug 14, 2025
Malicious code in speleology-puppeteer-optimize-css-assets-webpack-plugin-prettier-plugin-markdown (npm)
- Aug 14, 2025
Malicious code in speleology-nightwatch-centauri-sirius (npm)
- Aug 14, 2025
Malicious code in speleology-higgs-fomalhaut-iota (npm)
- Aug 14, 2025
Malicious code in speleology-cosmicsilence-javascript-sirius (npm)
- Aug 14, 2025
Malicious code in speleology-apollo-library-thuban (npm)
- Aug 14, 2025
Malicious code in spegularo (npm)
- Aug 14, 2025
Malicious code in speelhuis (npm)
- Aug 14, 2025
Malicious code in spectroscopy-spinner-version-request (npm)
- Aug 14, 2025
Malicious code in spectroscopy-mira-loopback-hexo (npm)
- Aug 14, 2025
Malicious code in spectron-webdriver-materialize-string-planckscale (npm)
Page 5347 of 6,665