Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in loom-plugin-babel (npm)
- Aug 14, 2025
Malicious code in loom-cli (npm)
- Aug 14, 2025
Malicious code in long-scale-static-report-float (npm)
- Aug 14, 2025
Malicious code in long-report-info-emulate-small (npm)
- Aug 14, 2025
Malicious code in long-boolean-thread-notify-fast (npm)
- Aug 14, 2025
Malicious code in lonelyme (npm)
- Aug 14, 2025
Malicious code in londieall (npm)
- Aug 14, 2025
Malicious code in lolpro (npm)
- Aug 14, 2025
Malicious code in lolock (npm)
- Aug 14, 2025
Malicious code in lolman (npm)
- Aug 14, 2025
Malicious code in lolis.life (npm)
- Aug 14, 2025
Malicious code in lolapifun (npm)
- Aug 14, 2025
Malicious code in loksabha (npm)
- Aug 14, 2025
Malicious code in lojack (npm)
- Aug 14, 2025
Malicious code in loguru (npm)
- Aug 14, 2025
Malicious code in logtoeye (npm)
- Aug 14, 2025
Malicious code in logsymbles (npm)
- Aug 14, 2025
Malicious code in logsoul (npm)
- Aug 14, 2025
Malicious code in logrocket-video-mirror (npm)
- Aug 14, 2025
Malicious code in logrocket-video-common (npm)
- Aug 14, 2025
Malicious code in logrocket-video (npm)
- Aug 14, 2025
Malicious code in logrocket-utils (npm)
- Aug 14, 2025
Malicious code in logrocket-protocol (npm)
- Aug 14, 2025
Malicious code in logrocket-prebuilt (npm)
- Aug 14, 2025
Malicious code in logrocket-network (npm)
- Aug 14, 2025
Malicious code in logrocket-navigation (npm)
- Aug 14, 2025
Malicious code in logrocket-fetch (npm)
- Aug 14, 2025
Malicious code in logrocket-dom (npm)
- Aug 14, 2025
Malicious code in logrocket-core-worker (npm)
- Aug 14, 2025
Malicious code in logrocket-core (npm)
- Aug 14, 2025
Malicious code in logrocket-browser (npm)
- Aug 14, 2025
Malicious code in logojoy-app (npm)
- Aug 14, 2025
Malicious code in logoiconic (npm)
- Aug 14, 2025
Malicious code in loglevel-whitedwarf-postcss-loader-betelgeuse (npm)
- Aug 14, 2025
Malicious code in loglevel-rate-limiter-perseus-playwright (npm)
- Aug 14, 2025
Malicious code in loglevel-paleobotany-subduction-postcss (npm)
- Aug 14, 2025
Malicious code in loglevel-docusaurus-scripts-less (npm)
- Aug 14, 2025
Malicious code in loglevel-australis-cors-ganymede (npm)
- Aug 14, 2025
Malicious code in loglevel-astro-docusaurus-adonis (npm)
- Aug 14, 2025
Malicious code in logincookie-paypal (npm)
- Aug 14, 2025
Malicious code in login-sbobet (npm)
- Aug 14, 2025
Malicious code in logicom (npm)
- Aug 14, 2025
Malicious code in logiciel (npm)
- Aug 14, 2025
Malicious code in logichex (npm)
- Aug 14, 2025
Malicious code in logging-repository (npm)
- Aug 14, 2025
Malicious code in logdoc (npm)
- Aug 14, 2025
Malicious code in logcry (npm)
- Aug 14, 2025
Malicious code in logbrewer (npm)
- Aug 14, 2025
Malicious code in loganmall (npm)
- Aug 14, 2025
Malicious code in logadmin (npm)
Page 5480 of 6,634