Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,499 total in npm · sorted newest first- Aug 14, 2025
Malicious code in dove-hammock-sio879-project (npm)
- Aug 14, 2025
Malicious code in dove-frost-wrh593-project (npm)
- Aug 14, 2025
Malicious code in dove-eagle-ilq381-project (npm)
- Aug 14, 2025
Malicious code in dove-crystal-kwd785-project (npm)
- Aug 14, 2025
Malicious code in dove-bonfire-vod852-project (npm)
- Aug 14, 2025
Malicious code in dove-blossom-swe867-project (npm)
- Aug 14, 2025
Malicious code in douquan (npm)
- Aug 14, 2025
Malicious code in doufuru (npm)
- Aug 14, 2025
Malicious code in double-string-log-test-assert (npm)
- Aug 14, 2025
Malicious code in dotyar (npm)
- Aug 14, 2025
Malicious code in dotenv-socketio-ichnology-higgs (npm)
- Aug 14, 2025
Malicious code in dotenv-safe-winston-dotenv-safe-markdown-pdf (npm)
- Aug 14, 2025
Malicious code in dotenv-safe-titan-terser-markdown (npm)
- Aug 14, 2025
Malicious code in dotenv-safe-query-transhumanism-cosmos (npm)
- Aug 14, 2025
Malicious code in dotenv-safe-neutrino-commitizen-supervisor (npm)
- Aug 14, 2025
Malicious code in dotenv-safe-mira-polaris-passport (npm)
- Aug 14, 2025
Malicious code in dotenv-safe-kastra-atlas-perturbation (npm)
- Aug 14, 2025
Malicious code in dotenv-safe-firebase-uninstall-innercore (npm)
- Aug 14, 2025
Malicious code in dotenv-safe-auriga-cz-conventional-changelog-castor (npm)
- Aug 14, 2025
Malicious code in dotenv-parse-variables-xanthus-nestjs-playwright (npm)
- Aug 14, 2025
Malicious code in dotenv-parse-variables-scorpius-borealis-style-loader (npm)
- Aug 14, 2025
Malicious code in dotenv-parse-variables-norma-adonis-duplex (npm)
- Aug 14, 2025
Malicious code in dotenv-parse-variables-neutrino-spinner-higgs (npm)
- Aug 14, 2025
Malicious code in dotenv-lib (npm)
- Aug 14, 2025
Malicious code in dotenv-fusion-ini-miranda (npm)
- Aug 14, 2025
Malicious code in dotenv-foundation-perseus-version (npm)
- Aug 14, 2025
Malicious code in dotenv-cryonics-rate-limiter-membrane (npm)
- Aug 14, 2025
Malicious code in dotenv-cosmos-taurus-kinetic (npm)
- Aug 14, 2025
Malicious code in dotenv-antares-exobiology-hermes (npm)
- Aug 14, 2025
Malicious code in dotconfig (npm)
- Aug 14, 2025
Malicious code in doscolors (npm)
- Aug 14, 2025
Malicious code in dormance (npm)
- Aug 14, 2025
Malicious code in dorkroom (npm)
- Aug 14, 2025
Malicious code in dordrecht (npm)
- Aug 14, 2025
Malicious code in dorado-quantum-miranda-grus (npm)
- Aug 14, 2025
Malicious code in dorado-metalsmith-heka-commitlint-config-angular (npm)
- Aug 14, 2025
Malicious code in dorado-html-webpack-plugin-less-procyon (npm)
- Aug 14, 2025
Malicious code in dorado-gravitationalwave-neutronstar-galaxy (npm)
- Aug 14, 2025
Malicious code in dorado-darkmatter-gravity-commitlint-config-angular (npm)
- Aug 14, 2025
Malicious code in dorado-aldebaran-hermes-react-bootstrap (npm)
- Aug 14, 2025
Malicious code in door (npm)
- Aug 14, 2025
Malicious code in doomclock (npm)
- Aug 14, 2025
Malicious code in donotinstallthis (npm)
- Aug 14, 2025
Malicious code in donotdownload (npm)
- Aug 14, 2025
Malicious code in dono-toge83-sukiwir (npm)
- Aug 14, 2025
Malicious code in dono-soto31-breki (npm)
- Aug 14, 2025
Malicious code in dono-rawon2-sukiwir (npm)
- Aug 14, 2025
Malicious code in dono-pisang2-breki (npm)
- Aug 14, 2025
Malicious code in dono-oblok12-breki (npm)
- Aug 14, 2025
Malicious code in dono-mieaceh30-breki (npm)
Page 5634 of 6,650