Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,689 total in npm · sorted newest first- Aug 14, 2025
Malicious code in momen (npm)
- Aug 14, 2025
Malicious code in momdnt (npm)
- Aug 14, 2025
Malicious code in moltin-coalesce-generic (npm)
- Aug 14, 2025
Malicious code in moltin-coalesce (npm)
- Aug 14, 2025
Malicious code in molscript (npm)
- Aug 14, 2025
Malicious code in molpay-mobile-sdk (npm)
- Aug 14, 2025
Malicious code in molecule_o6xjw_0rh6u_infinity (npm)
- Aug 14, 2025
Malicious code in molecule_h2ypp_dea3s_ocean (npm)
- Aug 14, 2025
Malicious code in mojodemo (npm)
- Aug 14, 2025
Malicious code in mojo-ui-components (npm)
- Aug 14, 2025
Malicious code in mojacesta (npm)
- Aug 14, 2025
Malicious code in mogoose (npm)
- Aug 14, 2025
Malicious code in mogodb-core (npm)
- Aug 14, 2025
Malicious code in mogodb (npm)
- Aug 14, 2025
Malicious code in mogobd (npm)
- Aug 14, 2025
Malicious code in module-templates-shared-modules (npm)
- Aug 14, 2025
Malicious code in module-speleology-style-loader-singularitarianism (npm)
- Aug 14, 2025
Malicious code in module-relationship (npm)
- Aug 14, 2025
Malicious code in module-paleobotany-module-supernova (npm)
- Aug 14, 2025
Malicious code in module-name (npm)
- Aug 14, 2025
Malicious code in module-lacerta-cosmos-webdriver-mocha (npm)
- Aug 14, 2025
Malicious code in module-electron-builder-decoherence-transhumanism (npm)
- Aug 14, 2025
Malicious code in module-draft-js-mention-plugin (npm)
- Aug 14, 2025
Malicious code in module-daemon-sun-stub-lambda (npm)
- Aug 14, 2025
Malicious code in module-astro-nashira-chariklo (npm)
- Aug 14, 2025
Malicious code in modtools (npm)
- Aug 14, 2025
Malicious code in modplay (npm)
- Aug 14, 2025
Malicious code in modown-static (npm)
- Aug 14, 2025
Malicious code in modown-micro (npm)
- Aug 14, 2025
Malicious code in modown-locator (npm)
- Aug 14, 2025
Malicious code in modown-handlebars (npm)
- Aug 14, 2025
Malicious code in modeus-legacy (npm)
- Aug 14, 2025
Malicious code in modeus-core (npm)
- Aug 14, 2025
Malicious code in models-frontend (npm)
- Aug 14, 2025
Malicious code in moddel (npm)
- Aug 14, 2025
Malicious code in modcraft (npm)
- Aug 14, 2025
Malicious code in mocktail.js (npm)
- Aug 14, 2025
Malicious code in mockia (npm)
- Aug 14, 2025
Malicious code in mockerbox (npm)
- Aug 14, 2025
Malicious code in mockdeb (npm)
- Aug 14, 2025
Malicious code in mock-uglify-short-char-catch (npm)
- Aug 14, 2025
Malicious code in mock-simulate-moon-sudo-export (npm)
- Aug 14, 2025
Malicious code in mock-cloud-encrypt-gamma-dog (npm)
- Aug 14, 2025
Malicious code in mochs (npm)
- Aug 14, 2025
Malicious code in mochq (npm)
- Aug 14, 2025
Malicious code in mochikun (npm)
- Aug 14, 2025
Malicious code in mocha-sedna-server-convict (npm)
- Aug 14, 2025
Malicious code in mocha-janus-shelljs-dorado (npm)
- Aug 14, 2025
Malicious code in mocha-helios-postgres-registry (npm)
- Aug 14, 2025
Malicious code in mocha-graphql-ursa-carina (npm)
Page 5459 of 6,634