Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,212 total in npm · sorted newest first- Aug 14, 2025
Malicious code in redshift-titan-6axh (npm)
- Aug 14, 2025
Malicious code in redshift-oscar-z6pt (npm)
- Aug 14, 2025
Malicious code in redshift-jsonp-triton-ursa (npm)
- Aug 14, 2025
Malicious code in redshift-delta-8zf3 (npm)
- Aug 14, 2025
Malicious code in redshift-bravo-odvs (npm)
- Aug 14, 2025
Malicious code in redshift-betelgeuse-aldebaran-corvus (npm)
- Aug 14, 2025
Malicious code in redlog (npm)
- Aug 14, 2025
Malicious code in redisws.server (npm)
- Aug 14, 2025
Malicious code in redis-webpack-bunyan-bellatrix (npm)
- Aug 14, 2025
Malicious code in redis-state (npm)
- Aug 14, 2025
Malicious code in redis-paleomagnetism-exoplanet-testcafe (npm)
- Aug 14, 2025
Malicious code in redis-mantle-andromeda-lint-staged (npm)
- Aug 14, 2025
Malicious code in redis-gacrux-astrochemistry-lint-staged (npm)
- Aug 14, 2025
Malicious code in redis-darkenergy-brane-polaris (npm)
- Aug 14, 2025
Malicious code in redis-cosmogenic-foundation-xanthus (npm)
- Aug 14, 2025
Malicious code in redis-clustre (npm)
- Aug 14, 2025
Malicious code in redis-chromedriver-typeorm-magellan (npm)
- Aug 14, 2025
Malicious code in redis-asteroid-outercore-entanglement (npm)
- Aug 14, 2025
Malicious code in redgiant-pm2-gridsome-fusion (npm)
- Aug 14, 2025
Malicious code in redgiant-luna-backend-framework (npm)
- Aug 14, 2025
Malicious code in redgiant-kardashevscale-accretion-cluster (npm)
- Aug 14, 2025
Malicious code in redgiant-celeste-innercore-betelgeuse (npm)
- Aug 14, 2025
Malicious code in redgiant-biohacking-chromedriver-titan (npm)
- Aug 14, 2025
Malicious code in reddited (npm)
- Aug 14, 2025
Malicious code in reddit-mobile-plugin-metrics (npm)
- Aug 14, 2025
Malicious code in reddit-mobile-plugin-ads (npm)
- Aug 14, 2025
Malicious code in reddit-mobile (npm)
- Aug 14, 2025
Malicious code in reddevdoc (npm)
- Aug 14, 2025
Malicious code in redcode (npm)
- Aug 14, 2025
Malicious code in redcedar (npm)
- Aug 14, 2025
Malicious code in redaxscript-flaticon (npm)
- Aug 14, 2025
Malicious code in redaction-lib-osx (npm)
- Aug 14, 2025
Malicious code in redaction-lib (npm)
- Aug 14, 2025
Malicious code in red-contrib-enable-gps (npm)
- Aug 14, 2025
Malicious code in recynex (npm)
- Aug 14, 2025
Malicious code in recursive-diff.js (npm)
- Aug 14, 2025
Malicious code in recsam (npm)
- Aug 14, 2025
Malicious code in recrutment (npm)
- Aug 14, 2025
Malicious code in recrut (npm)
- Aug 14, 2025
Malicious code in recriut (npm)
- Aug 14, 2025
Malicious code in record_query (npm)
- Aug 14, 2025
Malicious code in reconcast (npm)
- Aug 14, 2025
Malicious code in recojets (npm)
- Aug 14, 2025
Malicious code in recital (npm)
- Aug 14, 2025
Malicious code in recipe-archive (npm)
- Aug 14, 2025
Malicious code in recipants (npm)
- Aug 14, 2025
Malicious code in recents (npm)
- Aug 14, 2025
Malicious code in rebloc (npm)
- Aug 14, 2025
Malicious code in rebelspy (npm)
- Aug 14, 2025
Malicious code in reatc-native-components (npm)
Page 5383 of 6,665