Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in essence-dbif3-g4ce3-twilight-project (npm)
- Aug 14, 2025
Malicious code in essence-2eyt7-ftz97-verdant-project (npm)
- Aug 14, 2025
Malicious code in essence-18y8m-i7gf5-yellow-project (npm)
- Aug 14, 2025
Malicious code in esselin (npm)
- Aug 14, 2025
Malicious code in esri (npm)
- Aug 14, 2025
Malicious code in esprime (npm)
- Aug 14, 2025
Malicious code in esovtaj (npm)
- Aug 14, 2025
Malicious code in esolutions-ui-framework (npm)
- Aug 14, 2025
Malicious code in eslint-virtru-lint (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-virtru-lint (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-spectrum-web-components (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-restart-vega-soap (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-relay-internal (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-react-internal (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-pb (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-market (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-lwc (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-kg-jslint-codeanalyzers (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-jasmine-augmentedreality-airbnb (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-got-ursa-taurus (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-es-spec (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-coda-rules (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-cli (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-automation-custom (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-airbnb-base (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-airbnb (npm)
- Aug 14, 2025
Malicious code in eslint-plugin-aether-phenomic-redis (npm)
- Aug 14, 2025
Malicious code in eslint-jabbah-europa-markdown (npm)
- Aug 14, 2025
Malicious code in eslint-config-yandex-morda (npm)
- Aug 14, 2025
Malicious code in eslint-config-xtdet (npm)
- Aug 14, 2025
Malicious code in eslint-config-volebonet (npm)
- Aug 14, 2025
Malicious code in eslint-config-techintouch (npm)
- Aug 14, 2025
Malicious code in eslint-config-starry (npm)
- Aug 14, 2025
Malicious code in eslint-config-skyscanner-test (npm)
- Aug 14, 2025
Malicious code in eslint-config-sebastienbarre (npm)
- Aug 14, 2025
Malicious code in eslint-config-public-archaeometry-paleontology (npm)
- Aug 14, 2025
Malicious code in eslint-config-pardel (npm)
- Aug 14, 2025
Malicious code in eslint-config-ok (npm)
- Aug 14, 2025
Malicious code in eslint-config-lendesk (npm)
- Aug 14, 2025
Malicious code in eslint-config-kptests (npm)
- Aug 14, 2025
Malicious code in eslint-config-jitsi (npm)
- Aug 14, 2025
Malicious code in eslint-config-iot-app-kit (npm)
- Aug 14, 2025
Malicious code in eslint-config-inectum (npm)
- Aug 14, 2025
Malicious code in eslint-config-googlejs-es6 (npm)
1 compromised version
- Aug 14, 2025
Malicious code in eslint-config-gacrux-hercules-element-ui (npm)
- Aug 14, 2025
Malicious code in eslint-config-frantic1048 (npm)
- Aug 14, 2025
Malicious code in eslint-config-earnest (npm)
- Aug 14, 2025
Malicious code in eslint-config-data-ui (npm)
- Aug 14, 2025
Malicious code in eslint-config-coupang (npm)
- Aug 14, 2025
Malicious code in eslint-config-colourbox-example (npm)
Page 5594 of 6,634