Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in grape-foxtrot-nsrq (npm)
- Aug 14, 2025
Malicious code in grape-fhj-project (npm)
- Aug 14, 2025
Malicious code in grape-ew8-project (npm)
- Aug 14, 2025
Malicious code in grape-eul-project (npm)
- Aug 14, 2025
Malicious code in grape-date-uhon (npm)
- Aug 14, 2025
Malicious code in grape-cherry-fedo (npm)
- Aug 14, 2025
Malicious code in grape-brv-project (npm)
- Aug 14, 2025
Malicious code in grape-bravo-bwpu (npm)
- Aug 14, 2025
Malicious code in grape-boa-project (npm)
- Aug 14, 2025
Malicious code in grape-beetroot-n788 (npm)
- Aug 14, 2025
Malicious code in grape-banana-ksns (npm)
- Aug 14, 2025
Malicious code in grape-asteroid-krt5 (npm)
- Aug 14, 2025
Malicious code in grape-alpha-wuuc (npm)
- Aug 14, 2025
Malicious code in grape-9u7-project (npm)
- Aug 14, 2025
Malicious code in grape-9rp-project (npm)
- Aug 14, 2025
Malicious code in grape-67t-project (npm)
- Aug 14, 2025
Malicious code in grakopp (npm)
- Aug 14, 2025
Malicious code in grailedapi (npm)
- Aug 14, 2025
Malicious code in grafield (npm)
- Aug 14, 2025
Malicious code in grafanaversion (npm)
- Aug 14, 2025
Malicious code in grafana-toolkit (npm)
- Aug 14, 2025
Malicious code in graduation (npm)
- Aug 14, 2025
Malicious code in gradlew (npm)
- Aug 14, 2025
Malicious code in grabshot (npm)
- Aug 14, 2025
Malicious code in grablib (npm)
- Aug 14, 2025
Malicious code in grabit-utils (npm)
- Aug 14, 2025
Malicious code in grab-id-client (npm)
- Aug 14, 2025
Malicious code in gql-generated (npm)
- Aug 14, 2025
Malicious code in gpyblog (npm)
- Aug 14, 2025
Malicious code in gpxqsdzbhvoimeru (npm)
- Aug 14, 2025
Malicious code in gpustatjs (npm)
- Aug 14, 2025
Malicious code in gpumon-datadog (npm)
- Aug 14, 2025
Malicious code in gpswake (npm)
- Aug 14, 2025
Malicious code in gpsignup (npm)
- Aug 14, 2025
Malicious code in gpsfix (npm)
- Aug 14, 2025
Malicious code in gpscamera (npm)
- Aug 14, 2025
Malicious code in gpress (npm)
- Aug 14, 2025
Malicious code in gpnjxoyo10tkfvfnvt40kdaqoyl2e1ov (npm)
- Aug 14, 2025
Malicious code in gpgame (npm)
- Aug 14, 2025
Malicious code in gperiodic (npm)
- Aug 14, 2025
Malicious code in gpcembed (npm)
- Aug 14, 2025
Malicious code in gp-logger (npm)
- Aug 14, 2025
Malicious code in gp-db-models (npm)
- Aug 14, 2025
Malicious code in gourmetta (npm)
- Aug 14, 2025
Malicious code in gothimbl (npm)
- Aug 14, 2025
Malicious code in gotdone (npm)
- Aug 14, 2025
Malicious code in got-webpack-selenium-sails (npm)
- Aug 14, 2025
Malicious code in got-backend-pegasus-perseus (npm)
- Aug 14, 2025
Malicious code in got-atlas-inquirer-bulma (npm)
- Aug 14, 2025
Malicious code in gostatic (npm)
Page 5555 of 6,634