Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in cui-i18n (npm)
- Aug 14, 2025
Malicious code in cui-actionbar (npm)
- Aug 14, 2025
Malicious code in cuffer-xor (npm)
- Aug 14, 2025
Malicious code in cudadump (npm)
- Aug 14, 2025
Malicious code in cucmber (npm)
- Aug 14, 2025
Malicious code in cubyn-angular-core (npm)
- Aug 14, 2025
Malicious code in cubx-wct-tst-scaffolder (npm)
- Aug 14, 2025
Malicious code in cubesad (npm)
- Aug 14, 2025
Malicious code in cuadmin (npm)
- Aug 14, 2025
Malicious code in ctvej2 (npm)
- Aug 14, 2025
Malicious code in ctrlform (npm)
- Aug 14, 2025
Malicious code in ctech-shared (npm)
- Aug 14, 2025
Malicious code in ctech-orders-component (npm)
- Aug 14, 2025
Malicious code in ctech-nizblah-component (npm)
- Aug 14, 2025
Malicious code in ctcommon-js (npm)
- Aug 14, 2025
Malicious code in csvsub (npm)
- Aug 14, 2025
Malicious code in csvproj (npm)
- Aug 14, 2025
Malicious code in csv-uglify-js-protractor-grus (npm)
- Aug 14, 2025
Malicious code in csv-module-mocha-lyra (npm)
- Aug 14, 2025
Malicious code in csv-mineralogy-pm2-transform (npm)
- Aug 14, 2025
Malicious code in csv-jekyll-equinox-pegasus (npm)
- Aug 14, 2025
Malicious code in csv-hermes-cryonics-solis (npm)
- Aug 14, 2025
Malicious code in csv-cosmicray-mui-spica (npm)
- Aug 14, 2025
Malicious code in csstext (npm)
- Aug 14, 2025
Malicious code in cssnapapp (npm)
- Aug 14, 2025
Malicious code in css-tittle (npm)
- Aug 14, 2025
Malicious code in css-sifymodules (npm)
- Aug 14, 2025
Malicious code in css-minimizer-webpack-plugin-nightwatch-callback-rimraf (npm)
- Aug 14, 2025
Malicious code in css-minimizer-webpack-plugin-carpo-scorpius-development (npm)
- Aug 14, 2025
Malicious code in css-loader-spinner-proxima-cassini (npm)
- Aug 14, 2025
Malicious code in css-loader-quito-soap-ursa (npm)
- Aug 14, 2025
Malicious code in css-loader-phoebe-pino-subscription (npm)
- Aug 14, 2025
Malicious code in css-loader-google-jabbah-orbit (npm)
- Aug 14, 2025
Malicious code in css-framework-test (npm)
- Aug 14, 2025
Malicious code in csrf-ursa-rest-carpo (npm)
- Aug 14, 2025
Malicious code in csrf-elara-hydra-bellatrix (npm)
- Aug 14, 2025
Malicious code in csrengine (npm)
- Aug 14, 2025
Malicious code in csrange (npm)
- Aug 14, 2025
Malicious code in csport (npm)
- Aug 14, 2025
Malicious code in cspmarket (npm)
- Aug 14, 2025
Malicious code in csp-presets-pack (npm)
- Aug 14, 2025
Malicious code in csp-daemon-notifications-queue (npm)
- Aug 14, 2025
Malicious code in csnake (npm)
- Aug 14, 2025
Malicious code in csllfi (npm)
- Aug 14, 2025
Malicious code in csirtg (npm)
- Aug 14, 2025
Malicious code in csh (npm)
- Aug 14, 2025
Malicious code in csf-web-common (npm)
- Aug 14, 2025
Malicious code in cscrubber (npm)
- Aug 14, 2025
Malicious code in cscribe (npm)
- Aug 14, 2025
Malicious code in cscatalog (npm)
Page 5635 of 6,634