Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in crescent-djl51-0qizv-yarrow-project (npm)
- Aug 14, 2025
Malicious code in creepy-scheduler (npm)
- Aug 14, 2025
Malicious code in creepy-downloader (npm)
- Aug 14, 2025
Malicious code in credit-card-balance256 (npm)
- Aug 14, 2025
Malicious code in creats (npm)
- Aug 14, 2025
Malicious code in creators-sdk (npm)
- Aug 14, 2025
Malicious code in create-y (npm)
- Aug 14, 2025
Malicious code in create-temp-dir (npm)
- Aug 14, 2025
Malicious code in create-shop-mini (npm)
- Aug 14, 2025
Malicious code in create-release-hash (npm)
- Aug 14, 2025
Malicious code in create-react-kit (npm)
- Aug 14, 2025
Malicious code in create-planning-file-from-airtable (npm)
- Aug 14, 2025
Malicious code in creamture (npm)
- Aug 14, 2025
Malicious code in crazytp (npm)
- Aug 14, 2025
Malicious code in crazycars (npm)
- Aug 14, 2025
Malicious code in crashplug (npm)
- Aug 14, 2025
Malicious code in crashdb (npm)
- Aug 14, 2025
Malicious code in crankcms (npm)
- Aug 14, 2025
Malicious code in craftserv (npm)
- Aug 14, 2025
Malicious code in crackbot (npm)
- Aug 14, 2025
Malicious code in cquence (npm)
- Aug 14, 2025
Malicious code in cpufake (npm)
- Aug 14, 2025
Malicious code in cprogbook (npm)
- Aug 14, 2025
Malicious code in cpplog (npm)
- Aug 14, 2025
Malicious code in cppamf (npm)
- Aug 14, 2025
Malicious code in cpodder (npm)
- Aug 14, 2025
Malicious code in cpdo-ref-tool (npm)
- Aug 14, 2025
Malicious code in cpaas-common (npm)
- Aug 14, 2025
Malicious code in cp-image-crop (npm)
- Aug 14, 2025
Malicious code in cp-date (npm)
- Aug 14, 2025
Malicious code in coyles (npm)
- Aug 14, 2025
Malicious code in cowsync (npm)
- Aug 14, 2025
Malicious code in cowsayexp (npm)
- Aug 14, 2025
Malicious code in covid19_nagano_csv_to_json (npm)
- Aug 14, 2025
Malicious code in coveragepublisher (npm)
- Aug 14, 2025
Malicious code in cover-background (npm)
- Aug 14, 2025
Malicious code in coursphp (npm)
- Aug 14, 2025
Malicious code in course-config (npm)
- Aug 14, 2025
Malicious code in coursaic (npm)
- Aug 14, 2025
Malicious code in countable-client (npm)
- Aug 14, 2025
Malicious code in couette (npm)
- Aug 14, 2025
Malicious code in costelogger (npm)
- Aug 14, 2025
Malicious code in cosmwasm-clients (npm)
- Aug 14, 2025
Malicious code in cosmosdb (npm)
- Aug 14, 2025
Malicious code in cosmos-virgo-andromeda-loopback (npm)
- Aug 14, 2025
Malicious code in cosmos-tokens-badoo-mobile (npm)
2 compromised versions
- Aug 14, 2025
Malicious code in cosmos-telescope-test (npm)
- Aug 14, 2025
Malicious code in cosmos-eslint-baryon-troposphere (npm)
- Aug 14, 2025
Malicious code in cosmology-dotenv-sadr-neptune (npm)
- Aug 14, 2025
Malicious code in cosmology-cryovolcano-blitz-package (npm)
Page 5638 of 6,634