Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,242 total in npm · sorted newest first- Aug 14, 2025
Malicious code in spectron-webdriver-install-figures-baryon (npm)
- Aug 14, 2025
Malicious code in spectron-webdriver-cross-env-galaxy-parallax (npm)
- Aug 14, 2025
Malicious code in spectron-webdriver-atlas-geochemistry-node-sass (npm)
- Aug 14, 2025
Malicious code in spectron-on-callback-colors (npm)
- Aug 14, 2025
Malicious code in spectron-inquirer-zenobia-dotenv (npm)
- Aug 14, 2025
Malicious code in spectron-hapi-quark-miranda (npm)
- Aug 14, 2025
Malicious code in spectron-gemini-dotenv-centaurus (npm)
- Aug 14, 2025
Malicious code in spectron-cli-duplex-unuk (npm)
- Aug 14, 2025
Malicious code in spectron-biomimicry-brane-betelgeuse (npm)
- Aug 14, 2025
Malicious code in spectron-astrobiology-iota-antares (npm)
- Aug 14, 2025
Malicious code in spdiscovery (npm)
- Aug 14, 2025
Malicious code in spbmrc (npm)
- Aug 14, 2025
Malicious code in spawn-vortex-development-epimetheus (npm)
- Aug 14, 2025
Malicious code in spawn-spinner-stop-callisto (npm)
- Aug 14, 2025
Malicious code in spawn-less-loader-enif-quark (npm)
- Aug 14, 2025
Malicious code in spawn-ganymede-arcturus-dione (npm)
- Aug 14, 2025
Malicious code in spavezbe (npm)
- Aug 14, 2025
Malicious code in spastic (npm)
- Aug 14, 2025
Malicious code in sparsity (npm)
- Aug 14, 2025
Malicious code in sparkymud (npm)
- Aug 14, 2025
Malicious code in sparkive (npm)
- Aug 14, 2025
Malicious code in sparkies (npm)
- Aug 14, 2025
Malicious code in spark-qsaum-zm2eq-knoll-project (npm)
- Aug 14, 2025
Malicious code in spark-kt0s0-rqyop-quicksilver-project (npm)
- Aug 14, 2025
Malicious code in spark-i9mci-p4tlg-jade-project (npm)
- Aug 14, 2025
Malicious code in spark-haven-uqa530-project (npm)
- Aug 14, 2025
Malicious code in spark-essence-igy405-project (npm)
- Aug 14, 2025
Malicious code in spark-b1q60-tph0d-frost-project (npm)
- Aug 14, 2025
Malicious code in spark-6nas7-5mv2s-indigo-project (npm)
- Aug 14, 2025
Malicious code in sparctest (npm)
- Aug 14, 2025
Malicious code in spaceytd (npm)
- Aug 14, 2025
Malicious code in spacepool (npm)
- Aug 14, 2025
Malicious code in spacelike (npm)
- Aug 14, 2025
Malicious code in spacegold (npm)
- Aug 14, 2025
Malicious code in spacegems (npm)
- Aug 14, 2025
Malicious code in spa-test (npm)
- Aug 14, 2025
Malicious code in sp-tracking (npm)
- Aug 14, 2025
Malicious code in sp-tos (npm)
- Aug 14, 2025
Malicious code in sp-shop-browse (npm)
- Aug 14, 2025
Malicious code in sowxdipvuejnlgzh (npm)
- Aug 14, 2025
Malicious code in sowome (npm)
- Aug 14, 2025
Malicious code in sovietjs (npm)
- Aug 14, 2025
Malicious code in souvenirs (npm)
- Aug 14, 2025
Malicious code in sousai (npm)
- Aug 14, 2025
Malicious code in sourev2 (npm)
- Aug 14, 2025
Malicious code in sourev1-fix (npm)
- Aug 14, 2025
Malicious code in sourev1 (npm)
- Aug 14, 2025
Malicious code in soure-fix (npm)
- Aug 14, 2025
Malicious code in soupcycle (npm)
- Aug 14, 2025
Malicious code in soupcache (npm)
Page 5348 of 6,665