Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in gosocks (npm)
- Aug 14, 2025
Malicious code in goshell (npm)
- Aug 14, 2025
Malicious code in goshape (npm)
- Aug 14, 2025
Malicious code in gosbvypiawcuzexj (npm)
- Aug 14, 2025
Malicious code in gorilla-umbrella-hck963-project (npm)
- Aug 14, 2025
Malicious code in gorilla-tornado-qal524-project (npm)
- Aug 14, 2025
Malicious code in gorilla-strawberry-ylcg (npm)
- Aug 14, 2025
Malicious code in gorilla-redwood-tgom (npm)
- Aug 14, 2025
Malicious code in gorilla-igloo-g838 (npm)
- Aug 14, 2025
Malicious code in gorilla-harbor-uwo619-project (npm)
- Aug 14, 2025
Malicious code in gorilla-foxtrot-yqcj (npm)
- Aug 14, 2025
Malicious code in gorilla-fern-ohc952-project (npm)
- Aug 14, 2025
Malicious code in gorilla-fennel-yziu (npm)
- Aug 14, 2025
Malicious code in gorilla-dove-koz256-project (npm)
- Aug 14, 2025
Malicious code in gorilla-comet-txa5 (npm)
- Aug 14, 2025
Malicious code in gorilla-butterfly-yfl962-project (npm)
- Aug 14, 2025
Malicious code in gorge-yard-vso323-project (npm)
- Aug 14, 2025
Malicious code in gorge-xerox-asw449-project (npm)
- Aug 14, 2025
Malicious code in gorge-xenon-yln990-project (npm)
- Aug 14, 2025
Malicious code in gorge-wisp-xwv460-project (npm)
- Aug 14, 2025
Malicious code in gorge-topaz-ptp670-project (npm)
- Aug 14, 2025
Malicious code in gorge-tiger-jcf388-project (npm)
- Aug 14, 2025
Malicious code in gorge-prairie-mou652-project (npm)
- Aug 14, 2025
Malicious code in gorge-orchid-tts835-project (npm)
- Aug 14, 2025
Malicious code in gorge-mountain-oag677-project (npm)
- Aug 14, 2025
Malicious code in gorge-labyrinth-kqk027-project (npm)
- Aug 14, 2025
Malicious code in gorge-jasmine-fdb137-project (npm)
- Aug 14, 2025
Malicious code in gorge-jade-aal999-project (npm)
- Aug 14, 2025
Malicious code in gorge-everglow-deh404-project (npm)
- Aug 14, 2025
Malicious code in gorge-coral-mra909-project (npm)
- Aug 14, 2025
Malicious code in gorge-butterfly-vtm291-project (npm)
- Aug 14, 2025
Malicious code in gorestful (npm)
- Aug 14, 2025
Malicious code in gopuzzles (npm)
- Aug 14, 2025
Malicious code in gopstop (npm)
- Aug 14, 2025
Malicious code in goplay (npm)
- Aug 14, 2025
Malicious code in gophia (npm)
- Aug 14, 2025
Malicious code in goowitter (npm)
- Aug 14, 2025
Malicious code in goorm (npm)
- Aug 14, 2025
Malicious code in goooyu (npm)
- Aug 14, 2025
Malicious code in goograde (npm)
- Aug 14, 2025
Malicious code in googlesitekit-widgets (npm)
- Aug 14, 2025
Malicious code in googlesitekit-notifications (npm)
- Aug 14, 2025
Malicious code in googlesitekit-modules (npm)
- Aug 14, 2025
Malicious code in googlesitekit-data (npm)
- Aug 14, 2025
Malicious code in googlesitekit-components (npm)
- Aug 14, 2025
Malicious code in googlesitekit-api (npm)
- Aug 14, 2025
Malicious code in googleOAuthServer (npm)
- Aug 14, 2025
Malicious code in google-websockets-deneb-enif (npm)
- Aug 14, 2025
Malicious code in google-play-code-discount006 (npm)
- Aug 14, 2025
Malicious code in google-play-card-redeem192 (npm)
Page 5556 of 6,634