Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,242 total in npm · sorted newest first- Aug 14, 2025
Malicious code in sheduleme (npm)
- Aug 14, 2025
Malicious code in shazamapi-node (npm)
- Aug 14, 2025
Malicious code in shavesink (npm)
- Aug 14, 2025
Malicious code in sharppt (npm)
- Aug 14, 2025
Malicious code in sharpphp (npm)
- Aug 14, 2025
Malicious code in sharma (npm)
- Aug 14, 2025
Malicious code in sharkit (npm)
- Aug 14, 2025
Malicious code in sharkfear (npm)
- Aug 14, 2025
Malicious code in sharepe (npm)
- Aug 14, 2025
Malicious code in shareout (npm)
- Aug 14, 2025
Malicious code in sharenix (npm)
- Aug 14, 2025
Malicious code in sharejss (npm)
- Aug 14, 2025
Malicious code in shared_ui_components (npm)
- Aug 14, 2025
Malicious code in shared-styling (npm)
- Aug 14, 2025
Malicious code in shared-nav-ia-region-americas (npm)
- Aug 14, 2025
Malicious code in shapplib (npm)
- Aug 14, 2025
Malicious code in shanty (npm)
- Aug 14, 2025
Malicious code in shanejp777-frame-print (npm)
- Aug 14, 2025
Malicious code in shanaz (npm)
- Aug 14, 2025
Malicious code in shamash (npm)
- Aug 14, 2025
Malicious code in shallong (npm)
- Aug 14, 2025
Malicious code in shalk (npm)
- Aug 14, 2025
Malicious code in shaheer2002-todolist-2 (npm)
- Aug 14, 2025
Malicious code in shadydev (npm)
- Aug 14, 2025
Malicious code in shack-yurt-pmr5 (npm)
- Aug 14, 2025
Malicious code in shack-xylophone-yag8 (npm)
- Aug 14, 2025
Malicious code in shack-pulsar-yitx (npm)
- Aug 14, 2025
Malicious code in shack-observatory-mv7m (npm)
- Aug 14, 2025
Malicious code in shack-maple-h5xi (npm)
- Aug 14, 2025
Malicious code in shack-falcon-fwnm (npm)
- Aug 14, 2025
Malicious code in shack-comet-9me2 (npm)
- Aug 14, 2025
Malicious code in shabuside-mimi (npm)
- Aug 14, 2025
Malicious code in sha256-validation (npm)
31 compromised versions
- Aug 14, 2025
Malicious code in sha256-cbc (npm)
- Aug 14, 2025
Malicious code in sh-utils (npm)
- Aug 14, 2025
Malicious code in sgyums (npm)
- Aug 14, 2025
Malicious code in sgmulford (npm)
- Aug 14, 2025
Malicious code in sglk-dev-tools (npm)
- Aug 14, 2025
Malicious code in sgiuteg (npm)
- Aug 14, 2025
Malicious code in sgetris (npm)
- Aug 14, 2025
Malicious code in sfrewe23 (npm)
- Aug 14, 2025
Malicious code in sfi-service-ppn (npm)
- Aug 14, 2025
Malicious code in sfhbxpcjwmzriody (npm)
- Aug 14, 2025
Malicious code in sfgitdemo (npm)
- Aug 14, 2025
Malicious code in sffood (npm)
- Aug 14, 2025
Malicious code in sfcc-sdapi (npm)
- Aug 14, 2025
Malicious code in SexyJS (npm)
- Aug 14, 2025
Malicious code in sewing-kit-plugin-quilt (npm)
- Aug 14, 2025
Malicious code in sew23 (npm)
- Aug 14, 2025
Malicious code in setupvps (npm)
Page 5361 of 6,665