Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,689 total in npm · sorted newest first- Aug 14, 2025
Malicious code in november-f85-project (npm)
- Aug 14, 2025
Malicious code in november-elderberry-kiwi-plhfr (npm)
- Aug 14, 2025
Malicious code in november-echo-n5c6 (npm)
- Aug 14, 2025
Malicious code in november-date-usea (npm)
- Aug 14, 2025
Malicious code in november-date-papaya-udxfx (npm)
- Aug 14, 2025
Malicious code in november-cpt-project (npm)
- Aug 14, 2025
Malicious code in november-charlie-whiw (npm)
- Aug 14, 2025
Malicious code in november-bravo-ofof (npm)
- Aug 14, 2025
Malicious code in november-bo8-project (npm)
- Aug 14, 2025
Malicious code in november-banana-delta-uwfmc (npm)
- Aug 14, 2025
Malicious code in november-auy-project (npm)
- Aug 14, 2025
Malicious code in novatp (npm)
- Aug 14, 2025
Malicious code in novacredit (npm)
- Aug 14, 2025
Malicious code in nova_irh2t_0a6nu_infinity (npm)
- Aug 14, 2025
Malicious code in nova_hh317_f8vtz_thunder (npm)
- Aug 14, 2025
Malicious code in nova_ham37_lgzru_tundra (npm)
- Aug 14, 2025
Malicious code in nova-zooarchaeology-cryovolcano-ariel (npm)
- Aug 14, 2025
Malicious code in nova-xerxes-typeorm-browserify (npm)
- Aug 14, 2025
Malicious code in nova-uoho4-jtz6m-yarn-project (npm)
- Aug 14, 2025
Malicious code in nova-sqlite-jovian-development (npm)
- Aug 14, 2025
Malicious code in nova-react-bootstrap-supervisor-abiogenesis (npm)
- Aug 14, 2025
Malicious code in nova-private-quasarjet-hyperion (npm)
- Aug 14, 2025
Malicious code in nova-phoebe-biomimicry-fornax (npm)
- Aug 14, 2025
Malicious code in nova-p06d7-tnr1t-glen-project (npm)
- Aug 14, 2025
Malicious code in nova-interstellarmedium-perturbation-palynology (npm)
- Aug 14, 2025
Malicious code in nova-evtdo-km8su-pebble-project (npm)
- Aug 14, 2025
Malicious code in nova-carina-prettier-plugin-markdown-triton (npm)
- Aug 14, 2025
Malicious code in nova-asteroid-xanadu-transhumanism (npm)
- Aug 14, 2025
Malicious code in nova-altair-phenomic-gemini (npm)
- Aug 14, 2025
Malicious code in nova-7jcu0-dknw0-nymph-project (npm)
- Aug 14, 2025
Malicious code in nova-4vq18-qsa33-flame-project (npm)
- Aug 14, 2025
Malicious code in nouku-search (npm)
- Aug 14, 2025
Malicious code in notype (npm)
- Aug 14, 2025
Malicious code in nottrek (npm)
- Aug 14, 2025
Malicious code in notiserv (npm)
- Aug 14, 2025
Malicious code in notion-sdk-project (npm)
- Aug 14, 2025
Malicious code in notify-index-secure-process-cron (npm)
- Aug 14, 2025
Malicious code in notificationservice-frontend (npm)
- Aug 14, 2025
Malicious code in notification-queuer (npm)
- Aug 14, 2025
Malicious code in nothing-js (npm)
- Aug 14, 2025
Malicious code in notehub (npm)
- Aug 14, 2025
Malicious code in notebolt (npm)
- Aug 14, 2025
Malicious code in notchcpu (npm)
- Aug 14, 2025
Malicious code in notatop (npm)
- Aug 14, 2025
Malicious code in nostego (npm)
- Aug 14, 2025
Malicious code in nosqleast (npm)
- Aug 14, 2025
Malicious code in northstar-sprite (npm)
- Aug 14, 2025
Malicious code in northpole (npm)
- Aug 14, 2025
Malicious code in norrin-statserver-reader (npm)
- Aug 14, 2025
Malicious code in norrin-logger (npm)
Page 5436 of 6,634