Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in com.microsoft.azure.remote-rendering (npm)
- Aug 14, 2025
Malicious code in com.microsoft.azure.object-anchors.runtime (npm)
- Aug 14, 2025
Malicious code in com.microsoft.altspacevr_uploader (npm)
- Aug 14, 2025
Malicious code in com.magicleap.unityaudiotools (npm)
- Aug 14, 2025
Malicious code in com.google.android.appbundle (npm)
- Aug 14, 2025
Malicious code in com.digmap.voicerecog (npm)
- Aug 14, 2025
Malicious code in com.carriersedge.zonarsinglesignon (npm)
- Aug 14, 2025
Malicious code in com.appsflyer.app.letscook (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.phase (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.gamekit (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.gamecontroller (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.corehaptics (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.core (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.arcade.splashscreen (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.arcade.fairplay (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.arcade.cloudsaves (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.arcade.cloudkit (npm)
- Aug 14, 2025
Malicious code in com.apple.unityplugin.accessibility (npm)
- Aug 14, 2025
Malicious code in columnar (npm)
- Aug 14, 2025
Malicious code in colugo (npm)
- Aug 14, 2025
Malicious code in colro-name (npm)
- Aug 14, 2025
Malicious code in colresizable-egis (npm)
- Aug 14, 2025
Malicious code in colour-string (npm)
- Aug 14, 2025
Malicious code in colour-name (npm)
- Aug 14, 2025
Malicious code in colorv (npm)
- Aug 14, 2025
Malicious code in colors-personaly (npm)
- Aug 14, 2025
Malicious code in colors-person (npm)
- Aug 14, 2025
Malicious code in colors-npm-pino-pretty-electron-builder (npm)
- Aug 14, 2025
Malicious code in colors-materialize-astrochemistry-figures (npm)
- Aug 14, 2025
Malicious code in colors-lyra-scripts-exobiology (npm)
- Aug 14, 2025
Malicious code in colors-lacerta-dotenv-safe-xenon (npm)
- Aug 14, 2025
Malicious code in colors-express-jwt-corvus (npm)
- Aug 14, 2025
Malicious code in colors-bootes-publish-magellan (npm)
- Aug 14, 2025
Malicious code in colors-blitz-quasar-australis (npm)
- Aug 14, 2025
Malicious code in colormo (npm)
- Aug 14, 2025
Malicious code in colorapp (npm)
- Aug 14, 2025
Malicious code in color-convert-conversions (npm)
- Aug 14, 2025
Malicious code in colomb (npm)
- Aug 14, 2025
Malicious code in colo-detect-paypal (npm)
- Aug 14, 2025
Malicious code in colne (npm)
- Aug 14, 2025
Malicious code in collection-bb-blocks (npm)
- Aug 14, 2025
Malicious code in collageer (npm)
- Aug 14, 2025
Malicious code in coldworld (npm)
- Aug 14, 2025
Malicious code in coldkey (npm)
- Aug 14, 2025
Malicious code in coldcat (npm)
- Aug 14, 2025
Malicious code in cold-short-phi-public-code (npm)
- Aug 14, 2025
Malicious code in cold-analyze-code-cat-process (npm)
- Aug 14, 2025
Malicious code in cokedeluxe (npm)
- Aug 14, 2025
Malicious code in coinstrng (npm)
- Aug 14, 2025
Malicious code in coinstrig (npm)
Page 5645 of 6,634