Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,689 total in npm · sorted newest first- Aug 14, 2025
Malicious code in metabolomics-configstore-xenos-spawn (npm)
- Aug 14, 2025
Malicious code in metabolomics-boson-orogeny-oortcloud (npm)
- Aug 14, 2025
Malicious code in metabolomics-axios-webdriver-mocha-ethology (npm)
- Aug 14, 2025
Malicious code in metabolomics-apollo-brane-thermochronology (npm)
- Aug 14, 2025
Malicious code in meta_api (npm)
- Aug 14, 2025
Malicious code in meta-notify-rain-cat-fast (npm)
- Aug 14, 2025
Malicious code in meta-link-load-earth-parse (npm)
- Aug 14, 2025
Malicious code in meta-error-secure-encode-refactor (npm)
- Aug 14, 2025
Malicious code in meta-compile-shell-quick-resolve (npm)
- Aug 14, 2025
Malicious code in meta-bad-protected-orchestrate-serialize (npm)
- Aug 14, 2025
Malicious code in meta-analyze-cold-code-old (npm)
- Aug 14, 2025
Malicious code in messengr (npm)
- Aug 14, 2025
Malicious code in messages-outbound (npm)
- Aug 14, 2025
Malicious code in messagebot-core (npm)
- Aug 14, 2025
Malicious code in mesosphere-protoplanetarydisk-redis-colors (npm)
- Aug 14, 2025
Malicious code in mesosphere-proteomics-phoebe-kastra (npm)
- Aug 14, 2025
Malicious code in mesosphere-eslint-module-auth (npm)
- Aug 14, 2025
Malicious code in mesh-layers (npm)
- Aug 14, 2025
Malicious code in mesfer (npm)
- Aug 14, 2025
Malicious code in meryem (npm)
- Aug 14, 2025
Malicious code in mericsson-gatsby-source-contentful (npm)
- Aug 14, 2025
Malicious code in mergequeue-eval-mergequeue (npm)
- Aug 14, 2025
Malicious code in merchantprofiledataserv (npm)
- Aug 14, 2025
Malicious code in merchant_feedback-client (npm)
- Aug 14, 2025
Malicious code in merchant-newsletter-widget (npm)
- Aug 14, 2025
Malicious code in mercahnt (npm)
- Aug 14, 2025
Malicious code in meowhut (npm)
- Aug 14, 2025
Malicious code in meoion (npm)
- Aug 14, 2025
Malicious code in menus-indexer-trigger (npm)
- Aug 14, 2025
Malicious code in menupanda (npm)
- Aug 14, 2025
Malicious code in menupages (npm)
- Aug 14, 2025
Malicious code in mentors-sdk-js (npm)
- Aug 14, 2025
Malicious code in mensa-supervisor-coronalmassejection-semantic-ui (npm)
- Aug 14, 2025
Malicious code in mensa-local-mensa-protractor (npm)
- Aug 14, 2025
Malicious code in mensa-geochemistry-wavefunction-chakra-ui (npm)
- Aug 14, 2025
Malicious code in mensa-event-local-superagent (npm)
- Aug 14, 2025
Malicious code in mene-base (npm)
- Aug 14, 2025
Malicious code in mendiff (npm)
- Aug 14, 2025
Malicious code in mendelod (npm)
- Aug 14, 2025
Malicious code in menadi (npm)
- Aug 14, 2025
Malicious code in memoripy (npm)
- Aug 14, 2025
Malicious code in memophoto (npm)
- Aug 14, 2025
Malicious code in memoos (npm)
- Aug 14, 2025
Malicious code in memola (npm)
- Aug 14, 2025
Malicious code in memoize-with-leveldb (npm)
- Aug 14, 2025
Malicious code in memoize-sync (npm)
- Aug 14, 2025
Malicious code in memecodes (npm)
- Aug 14, 2025
Malicious code in memdiff (npm)
- Aug 14, 2025
Malicious code in memcached_store (npm)
- Aug 14, 2025
Malicious code in membrane-development-link-jabbah (npm)
Page 5467 of 6,634