Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,214 total in npm · sorted newest first- Aug 14, 2025
Malicious code in salvestus (npm)
- Aug 14, 2025
Malicious code in saltdb (npm)
- Aug 14, 2025
Malicious code in salsahpc (npm)
- Aug 14, 2025
Malicious code in salryana (npm)
- Aug 14, 2025
Malicious code in salesgui (npm)
- Aug 14, 2025
Malicious code in salesforce-knowledge (npm)
- Aug 14, 2025
Malicious code in salayout (npm)
- Aug 14, 2025
Malicious code in salami (npm)
- Aug 14, 2025
Malicious code in salahcsc (npm)
- Aug 14, 2025
Malicious code in sailwithme-frontend (npm)
- Aug 14, 2025
Malicious code in sails-generate-migrate-app (npm)
- Aug 14, 2025
Malicious code in sails-event-sirius-jwt (npm)
- Aug 14, 2025
Malicious code in sails-colors-dorado-indus (npm)
- Aug 14, 2025
Malicious code in sahale (npm)
- Aug 14, 2025
Malicious code in sagitta-redis-phoenix-inquirer (npm)
- Aug 14, 2025
Malicious code in sagitta-package-subscription-google (npm)
- Aug 14, 2025
Malicious code in sagitta-morgan-luna-octans (npm)
- Aug 14, 2025
Malicious code in sagitta-mongoose-gravitationalwave-postcss-loader (npm)
- Aug 14, 2025
Malicious code in sagitta-jovian-relay-hydra (npm)
- Aug 14, 2025
Malicious code in sagitta-halley-async-leda (npm)
- Aug 14, 2025
Malicious code in sagitta-chromedriver-radiometric-extremophile (npm)
- Aug 14, 2025
Malicious code in sagitta-cache-flare-paleontology (npm)
- Aug 14, 2025
Malicious code in sagitta-antd-castor-oberon (npm)
- Aug 14, 2025
Malicious code in sagermaker_notebooks_extension (npm)
- Aug 14, 2025
Malicious code in sagemaker_sharing_extension (npm)
- Aug 14, 2025
Malicious code in sagemaker_session_manager (npm)
- Aug 14, 2025
Malicious code in sagemaker_notebooks_extension (npm)
- Aug 14, 2025
Malicious code in sagemaker_examples (npm)
- Aug 14, 2025
Malicious code in sagemaker-forked-extensions (npm)
- Aug 14, 2025
Malicious code in sagedb (npm)
- Aug 14, 2025
Malicious code in saffron_vlrfe_de9i9_aurora (npm)
- Aug 14, 2025
Malicious code in saffron_tiu8b_jue34_molecule (npm)
- Aug 14, 2025
Malicious code in saffron_su8p6_01bph_willow (npm)
- Aug 14, 2025
Malicious code in saffron_1evz4_ubp97_molecule (npm)
- Aug 14, 2025
Malicious code in safe-chain-test (npm)
3 compromised versions
- Aug 14, 2025
Malicious code in sadr-transhumanism-janus-bootstrap (npm)
- Aug 14, 2025
Malicious code in sadr-sass-loader-darkmatter-redshift (npm)
- Aug 14, 2025
Malicious code in sadr-radioastronomy-speleology-stream (npm)
- Aug 14, 2025
Malicious code in sadr-nightwatch-sirius-meissa (npm)
- Aug 14, 2025
Malicious code in sadr-cache-update-module (npm)
- Aug 14, 2025
Malicious code in sadr-cache-optimize-css-assets-webpack-plugin-ursa (npm)
- Aug 14, 2025
Malicious code in sadr-blitz-capella-grus (npm)
- Aug 14, 2025
Malicious code in sadjad (npm)
- Aug 14, 2025
Malicious code in sadeweb (npm)
- Aug 14, 2025
Malicious code in saccorepo (npm)
- Aug 14, 2025
Malicious code in saber-string (npm)
- Aug 14, 2025
Malicious code in saber-run (npm)
- Aug 14, 2025
Malicious code in sabeerali (npm)
- Aug 14, 2025
Malicious code in sabbytest (npm)
- Aug 14, 2025
Malicious code in sabalan (npm)
Page 5369 of 6,665