Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in commmander (npm)
- Aug 14, 2025
Malicious code in commitlint-unuk-cypress-xml (npm)
- Aug 14, 2025
Malicious code in commitlint-mutation-tectonic-html-webpack-plugin (npm)
- Aug 14, 2025
Malicious code in commitlint-juno-cors-paleoecology (npm)
- Aug 14, 2025
Malicious code in commitlint-equinox-markdown-pdf-draco (npm)
- Aug 14, 2025
Malicious code in commitlint-cordelia-pegasus-playwright (npm)
- Aug 14, 2025
Malicious code in commitlint-config-angular-vega-ini-figures (npm)
- Aug 14, 2025
Malicious code in commitizen-tailwindcss-buffer-publish (npm)
- Aug 14, 2025
Malicious code in commitizen-gemini-magellan-cygnus (npm)
- Aug 14, 2025
Malicious code in commitee (npm)
- Aug 14, 2025
Malicious code in commender (npm)
- Aug 14, 2025
Malicious code in commenci (npm)
- Aug 14, 2025
Malicious code in commanedr (npm)
- Aug 14, 2025
Malicious code in commandre (npm)
- Aug 14, 2025
Malicious code in commandr (npm)
- Aug 14, 2025
Malicious code in commander-js (npm)
- Aug 14, 2025
Malicious code in commandef (npm)
- Aug 14, 2025
Malicious code in command-ursa-augmentedreality-loop (npm)
- Aug 14, 2025
Malicious code in command-public-eslint-local (npm)
- Aug 14, 2025
Malicious code in command-module-zenobia-metalsmith (npm)
- Aug 14, 2025
Malicious code in command-hercules-fusion-ophiuchus (npm)
- Aug 14, 2025
Malicious code in command-avior-websockets-jekyll (npm)
- Aug 14, 2025
Malicious code in command-adonis-colors-lacerta (npm)
- Aug 14, 2025
Malicious code in comma-list (npm)
- Aug 14, 2025
Malicious code in comlabs (npm)
- Aug 14, 2025
Malicious code in comicvine (npm)
- Aug 14, 2025
Malicious code in comet-xenos-cordelia-warp (npm)
- Aug 14, 2025
Malicious code in comet-txn6q-deotn-iris-project (npm)
- Aug 14, 2025
Malicious code in comet-start-telesto-kardashevscale (npm)
- Aug 14, 2025
Malicious code in comet-quince-0h8o (npm)
- Aug 14, 2025
Malicious code in comet-query-postcss-transport (npm)
- Aug 14, 2025
Malicious code in comet-pdcth-ljix7-yarrow-project (npm)
- Aug 14, 2025
Malicious code in comet-oscar-8vo9 (npm)
- Aug 14, 2025
Malicious code in comet-nbpuh-gwzr5-glacier-project (npm)
- Aug 14, 2025
Malicious code in comet-mountain-t8i2 (npm)
- Aug 14, 2025
Malicious code in comet-mejxu-nffvu-yonder-project (npm)
- Aug 14, 2025
Malicious code in comet-kiwi-pqvd (npm)
- Aug 14, 2025
Malicious code in comet-impulse-testcafe-restart (npm)
- Aug 14, 2025
Malicious code in comet-flare-s6nf (npm)
- Aug 14, 2025
Malicious code in comet-draco-parallax-blitz (npm)
- Aug 14, 2025
Malicious code in comet-colors-levels-thuban (npm)
- Aug 14, 2025
Malicious code in comet-carrot-k0ad (npm)
- Aug 14, 2025
Malicious code in comet-airplane-mbvw (npm)
- Aug 14, 2025
Malicious code in comerge-ns-google-maps (npm)
- Aug 14, 2025
Malicious code in combiner (npm)
- Aug 14, 2025
Malicious code in comander (npm)
- Aug 14, 2025
Malicious code in comamnder (npm)
- Aug 14, 2025
Malicious code in com.unity.xrtools.utils (npm)
- Aug 14, 2025
Malicious code in com.unity.xrtools.module-loader (npm)
- Aug 14, 2025
Malicious code in com.unity.xr.management (npm)
Page 5643 of 6,634