Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in config-command-apex-phoebe (npm)
- Aug 14, 2025
Malicious code in config-chai-publish-ganymede (npm)
- Aug 14, 2025
Malicious code in config-blackhole-xerxes-titan (npm)
- Aug 14, 2025
Malicious code in config-app (npm)
- Aug 14, 2025
Malicious code in conferer (npm)
- Aug 14, 2025
Malicious code in confbot (npm)
- Aug 14, 2025
Malicious code in concurrently-transhumanism-selenium-fork (npm)
- Aug 14, 2025
Malicious code in concurrently-local-antares-materialize (npm)
- Aug 14, 2025
Malicious code in concurrently-centauri-planetology-archaeometry (npm)
- Aug 14, 2025
Malicious code in conagua (npm)
- Aug 14, 2025
Malicious code in comradefy (npm)
- Aug 14, 2025
Malicious code in compton (npm)
- Aug 14, 2025
Malicious code in compress-route-query-route-permission (npm)
- Aug 14, 2025
Malicious code in compress-process-sandbox-float-validate (npm)
- Aug 14, 2025
Malicious code in compress-img-and-upload-to-s3-securely-pretty-please-with-sugar-on-top (npm)
- Aug 14, 2025
Malicious code in compress-decrypt-load-kernel-delta (npm)
- Aug 14, 2025
Malicious code in composer-connector-harmony-hlfv1 (npm)
- Aug 14, 2025
Malicious code in component-emiter (npm)
- Aug 14, 2025
Malicious code in component-dfp (npm)
- Aug 14, 2025
Malicious code in component-adhese (npm)
- Aug 14, 2025
Malicious code in componenet-classes (npm)
- Aug 14, 2025
Malicious code in compliantcenter (npm)
- Aug 14, 2025
Malicious code in compliancereadserv (npm)
- Aug 14, 2025
Malicious code in compiti (npm)
- Aug 14, 2025
Malicious code in compile-serialize-uglify-book-simulate (npm)
- Aug 14, 2025
Malicious code in compile-dog-resolve-java-slow (npm)
- Aug 14, 2025
Malicious code in compilat (npm)
- Aug 14, 2025
Malicious code in compares (npm)
- Aug 14, 2025
Malicious code in companies-matcher (npm)
- Aug 14, 2025
Malicious code in comons-paypal (npm)
- Aug 14, 2025
Malicious code in como-rastrear-un-iphone (npm)
- Aug 14, 2025
Malicious code in como-rastrear-un-celular (npm)
- Aug 14, 2025
Malicious code in como-hackear-whatsapp (npm)
- Aug 14, 2025
Malicious code in como-hackear-un-facebook (npm)
- Aug 14, 2025
Malicious code in como-espiar-whatsapp-sin-codigo-qr (npm)
- Aug 14, 2025
Malicious code in como-espiar-whatsapp-de-forma-segura (npm)
- Aug 14, 2025
Malicious code in commtool (npm)
- Aug 14, 2025
Malicious code in commsecjs (npm)
- Aug 14, 2025
Malicious code in commqnder (npm)
- Aug 14, 2025
Malicious code in commons-paypal (npm)
- Aug 14, 2025
Malicious code in common_controllers (npm)
- Aug 14, 2025
Malicious code in common-styles (npm)
- Aug 14, 2025
Malicious code in common-server-utils (npm)
- Aug 14, 2025
Malicious code in common-pointer-cellotrack-api (npm)
- Aug 14, 2025
Malicious code in common-node-libraries (npm)
- Aug 14, 2025
Malicious code in common-modal-module (npm)
- Aug 14, 2025
Malicious code in common-js-support (npm)
- Aug 14, 2025
Malicious code in common-angular-test (npm)
- Aug 14, 2025
Malicious code in commodity-node (npm)
- Aug 14, 2025
Malicious code in commnader (npm)
Page 5642 of 6,634