Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in dune-jade-plw648-project (npm)
- Aug 14, 2025
Malicious code in dune-iguana-wtw825-project (npm)
- Aug 14, 2025
Malicious code in dune-icicle-ixm344-project (npm)
- Aug 14, 2025
Malicious code in dune-forest-ewr577-project (npm)
- Aug 14, 2025
Malicious code in dune-everglow-qoe118-project (npm)
- Aug 14, 2025
Malicious code in dune-eprt0-ov9mj-boulder-project (npm)
- Aug 14, 2025
Malicious code in dune-bonfire-nvp542-project (npm)
- Aug 14, 2025
Malicious code in dune-0ilyc-fiapo-moondust-project (npm)
- Aug 14, 2025
Malicious code in duncand (npm)
- Aug 14, 2025
Malicious code in dumbrocks (npm)
- Aug 14, 2025
Malicious code in duinomite (npm)
- Aug 14, 2025
Malicious code in duhovni (npm)
- Aug 14, 2025
Malicious code in duemail (npm)
- Aug 14, 2025
Malicious code in duelstick (npm)
- Aug 14, 2025
Malicious code in duel-core (npm)
- Aug 14, 2025
Malicious code in dudelols (npm)
- Aug 14, 2025
Malicious code in ductus (npm)
- Aug 14, 2025
Malicious code in ducanh1368-gas-convert (npm)
- Aug 14, 2025
Malicious code in duba (npm)
- Aug 14, 2025
Malicious code in duanlian (npm)
- Aug 14, 2025
Malicious code in duabot (npm)
- Aug 14, 2025
Malicious code in dtrundle (npm)
- Aug 14, 2025
Malicious code in dtmcsbhjevgqnxua (npm)
- Aug 14, 2025
Malicious code in dtljayqkgwxrmvku (npm)
- Aug 14, 2025
Malicious code in dtcleaner (npm)
- Aug 14, 2025
Malicious code in dt-oneagent-tailor (npm)
- Aug 14, 2025
Malicious code in dsvqozpircyntxgb (npm)
- Aug 14, 2025
Malicious code in dspython (npm)
- Aug 14, 2025
Malicious code in dspreso (npm)
- Aug 14, 2025
Malicious code in dspmgr (npm)
- Aug 14, 2025
Malicious code in dsounite (npm)
- Aug 14, 2025
Malicious code in dsnippets (npm)
- Aug 14, 2025
Malicious code in dslive (npm)
- Aug 14, 2025
Malicious code in dslash-parser (npm)
- Aug 14, 2025
Malicious code in dshelx (npm)
- Aug 14, 2025
Malicious code in dshellx (npm)
- Aug 14, 2025
Malicious code in dshelld (npm)
- Aug 14, 2025
Malicious code in dshellb (npm)
- Aug 14, 2025
Malicious code in dshella (npm)
- Aug 14, 2025
Malicious code in dsfserewkbc (npm)
- Aug 14, 2025
Malicious code in dsfserewkbb (npm)
- Aug 14, 2025
Malicious code in dsfserewkbaz (npm)
- Aug 14, 2025
Malicious code in dsfserewkbax (npm)
- Aug 14, 2025
Malicious code in dsfserewkbaw (npm)
- Aug 14, 2025
Malicious code in dsfserewkbav (npm)
- Aug 14, 2025
Malicious code in dsfserewkbau (npm)
- Aug 14, 2025
Malicious code in dsfserewkbat (npm)
- Aug 14, 2025
Malicious code in dsfserewkbas (npm)
- Aug 14, 2025
Malicious code in dsfserewkbar (npm)
- Aug 14, 2025
Malicious code in dsfserewkbaq (npm)
Page 5612 of 6,634