Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in galaxy-anchor-o7nb (npm)
- Aug 14, 2025
Malicious code in galaxy-altair-babel-link (npm)
- Aug 14, 2025
Malicious code in galaxy-alpha-e4oz (npm)
- Aug 14, 2025
Malicious code in gajira-cli (npm)
- Aug 14, 2025
Malicious code in gahrinish (npm)
- Aug 14, 2025
Malicious code in gagenda (npm)
- Aug 14, 2025
Malicious code in gaeblog (npm)
- Aug 14, 2025
Malicious code in gadzillion (npm)
- Aug 14, 2025
Malicious code in gadgetrie (npm)
- Aug 14, 2025
Malicious code in gacrux-tailwindcss-io-hyperion (npm)
- Aug 14, 2025
Malicious code in gacrux-start-mesosphere-vuepress (npm)
- Aug 14, 2025
Malicious code in gacrux-sedna-release-it-css-loader (npm)
- Aug 14, 2025
Malicious code in gacrux-rocket-ganymede-technocracy (npm)
- Aug 14, 2025
Malicious code in gacrux-promise-vega-umbriel (npm)
- Aug 14, 2025
Malicious code in gacrux-promise-test-apollo (npm)
- Aug 14, 2025
Malicious code in gacrux-iota-exec-shelljs (npm)
- Aug 14, 2025
Malicious code in gacor (npm)
- Aug 14, 2025
Malicious code in gacdata (npm)
- Aug 14, 2025
Malicious code in gabagoojs (npm)
- Aug 14, 2025
Malicious code in gaaaaaam (npm)
- Aug 14, 2025
Malicious code in g2plot-geo-world-map (npm)
2 compromised versions
- Aug 14, 2025
Malicious code in g2a-tooltip (npm)
- Aug 14, 2025
Malicious code in fzz-plugin (npm)
- Aug 14, 2025
Malicious code in fzylpgnxtawmihqs (npm)
- Aug 14, 2025
Malicious code in fzantalis (npm)
- Aug 14, 2025
Malicious code in fxtrader (npm)
- Aug 14, 2025
Malicious code in fxlnvythpzujcoks (npm)
- Aug 14, 2025
Malicious code in fxjewh (npm)
- Aug 14, 2025
Malicious code in fxgcsmkrdalviuhz (npm)
- Aug 14, 2025
Malicious code in fxcess (npm)
- Aug 14, 2025
Malicious code in fx-private-relay (npm)
- Aug 14, 2025
Malicious code in fvger3 (npm)
- Aug 14, 2025
Malicious code in fv333 (npm)
- Aug 14, 2025
Malicious code in fuzzyj (npm)
- Aug 14, 2025
Malicious code in fuze-node (npm)
- Aug 14, 2025
Malicious code in fuusen (npm)
- Aug 14, 2025
Malicious code in futurology-parsec-blackhole-browserify (npm)
- Aug 14, 2025
Malicious code in futurology-babel-ionosphere-sequelize (npm)
- Aug 14, 2025
Malicious code in futurology-ariel-troposphere-mineralogy (npm)
- Aug 14, 2025
Malicious code in futuresjs (npm)
- Aug 14, 2025
Malicious code in futuota (npm)
- Aug 14, 2025
Malicious code in futilewm (npm)
- Aug 14, 2025
Malicious code in futebot (npm)
- Aug 14, 2025
Malicious code in fusion-theme (npm)
- Aug 14, 2025
Malicious code in fusion-starter-build-scripts (npm)
- Aug 14, 2025
Malicious code in fusion-starter (npm)
- Aug 14, 2025
Malicious code in fusion-plugin-urate (npm)
- Aug 14, 2025
Malicious code in fusion-plugin-tracer (npm)
- Aug 14, 2025
Malicious code in fusion-plugin-tchannel (npm)
- Aug 14, 2025
Malicious code in fusion-plugin-secure-headers (npm)
Page 5569 of 6,634