Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in cs3f3 (npm)
- Aug 14, 2025
Malicious code in cs-security-service-client (npm)
- Aug 14, 2025
Malicious code in cs-config-loader (npm)
- Aug 14, 2025
Malicious code in crytpo-js (npm)
- Aug 14, 2025
Malicious code in crystal_thjar_m5c4y_glacier (npm)
- Aug 14, 2025
Malicious code in crystal_ri6q3_uzx74_maple (npm)
- Aug 14, 2025
Malicious code in crystal_o6v5d_6uqmd_rose (npm)
- Aug 14, 2025
Malicious code in crystal_dnfos_cr5w6_banyan (npm)
- Aug 14, 2025
Malicious code in crystal_apwqc_v34ez_horizon (npm)
- Aug 14, 2025
Malicious code in crystal_4qe4l_rhj7s_driftwood (npm)
- Aug 14, 2025
Malicious code in crystal_3ccu4_x1kfu_topaz (npm)
- Aug 14, 2025
Malicious code in crystal-zenith-rmu212-project (npm)
- Aug 14, 2025
Malicious code in crystal-xenon-gjy619-project (npm)
- Aug 14, 2025
Malicious code in crystal-wisp-mfe118-project (npm)
- Aug 14, 2025
Malicious code in crystal-vulture-ywt305-project (npm)
- Aug 14, 2025
Malicious code in crystal-valley-ylr140-project (npm)
- Aug 14, 2025
Malicious code in crystal-umbra-iou482-project (npm)
- Aug 14, 2025
Malicious code in crystal-spruce-blg242-project (npm)
- Aug 14, 2025
Malicious code in crystal-quagmire-vhk175-project (npm)
- Aug 14, 2025
Malicious code in crystal-penguin-wst341-project (npm)
- Aug 14, 2025
Malicious code in crystal-penguin-bfw198-project (npm)
- Aug 14, 2025
Malicious code in crystal-opaline-swi214-project (npm)
- Aug 14, 2025
Malicious code in crystal-leopard-oco404-project (npm)
- Aug 14, 2025
Malicious code in crystal-leopard-mts994-project (npm)
- Aug 14, 2025
Malicious code in crystal-j42za-ediwm-breeze-project (npm)
- Aug 14, 2025
Malicious code in crystal-icicle-srr504-project (npm)
- Aug 14, 2025
Malicious code in crystal-fern-hmh294-project (npm)
- Aug 14, 2025
Malicious code in crystal-fern-gbk022-project (npm)
- Aug 14, 2025
Malicious code in crystal-dawn-und555-project (npm)
- Aug 14, 2025
Malicious code in crystal-dandelion-trs728-project (npm)
- Aug 14, 2025
Malicious code in crystal-70h3z-xxzc7-glow-project (npm)
- Aug 14, 2025
Malicious code in cryptutils-paypal (npm)
- Aug 14, 2025
Malicious code in crypttime (npm)
- Aug 14, 2025
Malicious code in cryptopjs (npm)
- Aug 14, 2025
Malicious code in cryptography-tectonic-hermes-semantic-ui (npm)
- Aug 14, 2025
Malicious code in cryptography-markdown-neutronstar-configstore (npm)
- Aug 14, 2025
Malicious code in cryptography-dagda-mini-css-extract-plugin-jabbah (npm)
- Aug 14, 2025
Malicious code in cryptography-blackhole-helios-meteor (npm)
- Aug 14, 2025
Malicious code in crypto-primitives-ts (npm)
- Aug 14, 2025
Malicious code in crypto-paypal (npm)
- Aug 14, 2025
Malicious code in crypto-cookie-factory (npm)
- Aug 14, 2025
Malicious code in cryonics-yaml-meteor-subscription (npm)
- Aug 14, 2025
Malicious code in cryonics-venus-magnetosphere-cluster (npm)
- Aug 14, 2025
Malicious code in cryonics-sublimation-transform-pegasus (npm)
- Aug 14, 2025
Malicious code in cryonics-registry-graviton-loopback (npm)
- Aug 14, 2025
Malicious code in crxclone (npm)
- Aug 14, 2025
Malicious code in crust-socketio-prettier-stylelint-registry (npm)
- Aug 14, 2025
Malicious code in crust-jekyll-perturbation-protoplanetarydisk (npm)
- Aug 14, 2025
Malicious code in crust-epigenetics-halley-mysql (npm)
- Aug 14, 2025
Malicious code in crust-cosmiconfig-less-atlas (npm)
Page 5636 of 6,634