Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in converted (npm)
- Aug 14, 2025
Malicious code in conversa (npm)
- Aug 14, 2025
Malicious code in controlm (npm)
- Aug 14, 2025
Malicious code in contracts-plugins (npm)
- Aug 14, 2025
Malicious code in contohkey (npm)
- Aug 14, 2025
Malicious code in continent (npm)
- Aug 14, 2025
Malicious code in context-validators (npm)
- Aug 14, 2025
Malicious code in context-log (npm)
- Aug 14, 2025
Malicious code in contentful-build-bot (npm)
- Aug 14, 2025
Malicious code in contentchef-management-js-client (npm)
- Aug 14, 2025
Malicious code in content-tags (npm)
- Aug 14, 2025
Malicious code in content-cloud-validator-tool (npm)
- Aug 14, 2025
Malicious code in content-chef-components (npm)
- Aug 14, 2025
Malicious code in contee (npm)
- Aug 14, 2025
Malicious code in contax (npm)
- Aug 14, 2025
Malicious code in container-private-psi-long-enum (npm)
- Aug 14, 2025
Malicious code in container-dog-omicron-beta-route (npm)
- Aug 14, 2025
Malicious code in container-await-emulate-double-orchestrate (npm)
- Aug 14, 2025
Malicious code in consumerweb-logger (npm)
- Aug 14, 2025
Malicious code in consul-peerings (npm)
- Aug 14, 2025
Malicious code in consul-partitions (npm)
- Aug 14, 2025
Malicious code in consul-lock-sessions (npm)
- Aug 14, 2025
Malicious code in consul-hcp (npm)
- Aug 14, 2025
Malicious code in consul-acls (npm)
- Aug 14, 2025
Malicious code in constant_resolver (npm)
- Aug 14, 2025
Malicious code in consolerotate (npm)
- Aug 14, 2025
Malicious code in consent_decree (npm)
- Aug 14, 2025
Malicious code in connectservice (npm)
- Aug 14, 2025
Malicious code in connected-cells (npm)
- Aug 14, 2025
Malicious code in connect-mayfly (npm)
- Aug 14, 2025
Malicious code in conmendator-api-client (npm)
- Aug 14, 2025
Malicious code in conlogmon (npm)
- Aug 14, 2025
Malicious code in conkool (npm)
- Aug 14, 2025
Malicious code in conistring (npm)
- Aug 14, 2025
Malicious code in conifer-spinach-pbtu (npm)
- Aug 14, 2025
Malicious code in congstudy (npm)
- Aug 14, 2025
Malicious code in congrs (npm)
- Aug 14, 2025
Malicious code in congqian (npm)
- Aug 14, 2025
Malicious code in confluent-examples-nodejs (npm)
- Aug 14, 2025
Malicious code in confkit-notifier-slack (npm)
- Aug 14, 2025
Malicious code in confkit-commons (npm)
- Aug 14, 2025
Malicious code in confkit-base-module-defaultheaders (npm)
- Aug 14, 2025
Malicious code in confkit-base (npm)
- Aug 14, 2025
Malicious code in confit_mod (npm)
- Aug 14, 2025
Malicious code in configure-measure (npm)
- Aug 14, 2025
Malicious code in configstore-cluster-cors-react-bootstrap (npm)
- Aug 14, 2025
Malicious code in config-stratigraphy-geochemistry-bunyan (npm)
- Aug 14, 2025
Malicious code in config-management-cli (npm)
- Aug 14, 2025
Malicious code in config-genomics-jekyll-ganymede (npm)
- Aug 14, 2025
Malicious code in config-doc (npm)
Page 5641 of 6,634