Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in f39qm5 (npm)
- Aug 14, 2025
Malicious code in f34th3r-react-components (npm)
- Aug 14, 2025
Malicious code in f-deku (npm)
- Aug 14, 2025
Malicious code in ezvbby (npm)
- Aug 14, 2025
Malicious code in eztxter (npm)
- Aug 14, 2025
Malicious code in eztrade (npm)
- Aug 14, 2025
Malicious code in ezmoodle (npm)
- Aug 14, 2025
Malicious code in ezedit (npm)
- Aug 14, 2025
Malicious code in eywkwae (npm)
- Aug 14, 2025
Malicious code in eyisozlrnavjwhkc (npm)
- Aug 14, 2025
Malicious code in eyexam (npm)
- Aug 14, 2025
Malicious code in eyeos-extra (npm)
- Aug 14, 2025
Malicious code in exutil (npm)
- Aug 14, 2025
Malicious code in extremophile-venus-neptune-run-script (npm)
- Aug 14, 2025
Malicious code in extremophile-morgan-indus-fermion (npm)
- Aug 14, 2025
Malicious code in extremophile-electron-blueshift-wormhole (npm)
- Aug 14, 2025
Malicious code in extraction-test-react-utilities (npm)
- Aug 14, 2025
Malicious code in extraction-test-javascript-utilities (npm)
- Aug 14, 2025
Malicious code in external-api (npm)
- Aug 14, 2025
Malicious code in extension-point-as-vanity-pricing (npm)
- Aug 14, 2025
Malicious code in ext-zip (npm)
- Aug 14, 2025
Malicious code in exsemt (npm)
- Aug 14, 2025
Malicious code in exrpess (npm)
- Aug 14, 2025
Malicious code in exprss (npm)
- Aug 14, 2025
Malicious code in exprses (npm)
- Aug 14, 2025
Malicious code in exprono (npm)
- Aug 14, 2025
Malicious code in expressjs-mynodeutils (npm)
- Aug 14, 2025
Malicious code in expressful-tools (npm)
- Aug 14, 2025
Malicious code in ExpressCart (npm)
- Aug 14, 2025
Malicious code in express-ycsrf (npm)
- Aug 14, 2025
Malicious code in express-yandex-host-fallback (npm)
- Aug 14, 2025
Malicious code in express-yandex-csp (npm)
- Aug 14, 2025
Malicious code in express-ya-frameguard (npm)
- Aug 14, 2025
Malicious code in express-whitedwarf-augmentedreality-cluster (npm)
- Aug 14, 2025
Malicious code in express-websockets-sedna-mongodb (npm)
- Aug 14, 2025
Malicious code in express-uatraits-mock (npm)
- Aug 14, 2025
Malicious code in express-uatraits-extend (npm)
- Aug 14, 2025
Malicious code in express-transport-celeste-carpo (npm)
- Aug 14, 2025
Malicious code in express-tld (npm)
- Aug 14, 2025
Malicious code in express-sso (npm)
- Aug 14, 2025
Malicious code in express-secretkey (npm)
- Aug 14, 2025
Malicious code in express-renew-bb-session (npm)
- Aug 14, 2025
Malicious code in express-national-redirect2 (npm)
- Aug 14, 2025
Malicious code in express-middleware-ip-blocker (npm)
- Aug 14, 2025
Malicious code in express-meta (npm)
- Aug 14, 2025
Malicious code in express-meetings (npm)
- Aug 14, 2025
Malicious code in express-langdetect (npm)
- Aug 14, 2025
Malicious code in express-juggernaut (npm)
- Aug 14, 2025
Malicious code in express-image-bunker (npm)
- Aug 14, 2025
Malicious code in express-http-uatraits (npm)
Page 5589 of 6,634