Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in cmf.mes.material (npm)
- Aug 14, 2025
Malicious code in cmf.mes.mapping (npm)
- Aug 14, 2025
Malicious code in cmf.mes.maintenance (npm)
- Aug 14, 2025
Malicious code in cmf.mes.examples (npm)
- Aug 14, 2025
Malicious code in cmf.mes.datacollection (npm)
- Aug 14, 2025
Malicious code in cmf.mes.business.controls (npm)
- Aug 14, 2025
Malicious code in cmf.mes (npm)
- Aug 14, 2025
Malicious code in cmbalance (npm)
- Aug 14, 2025
Malicious code in cmantix (npm)
- Aug 14, 2025
Malicious code in cmanes (npm)
- Aug 14, 2025
Malicious code in cm-npm (npm)
- Aug 14, 2025
Malicious code in cm-materialjs (npm)
- Aug 14, 2025
Malicious code in cm-graphjs (npm)
- Aug 14, 2025
Malicious code in cm-api (npm)
- Aug 14, 2025
Malicious code in cm-algorithmjs (npm)
- Aug 14, 2025
Malicious code in clusterpoint-api-v4 (npm)
- Aug 14, 2025
Malicious code in cluster-xenobiology-inflation-mongodb (npm)
- Aug 14, 2025
Malicious code in cluster-transpile-java-simple-balance (npm)
- Aug 14, 2025
Malicious code in cluster-sudo-fast-info-iota (npm)
- Aug 14, 2025
Malicious code in cluster-registry (npm)
- Aug 14, 2025
Malicious code in cluster-publish-firebase-module (npm)
- Aug 14, 2025
Malicious code in cluster-petrology-thuban-protractor (npm)
- Aug 14, 2025
Malicious code in cluster-pegasus-cluster-geoarchaeology (npm)
- Aug 14, 2025
Malicious code in cluster-nextjs-html-webpack-plugin-scripts (npm)
- Aug 14, 2025
Malicious code in cluster-middleware-parcel-flare (npm)
- Aug 14, 2025
Malicious code in cluster-lithosphere-baryon-gammarayburst (npm)
- Aug 14, 2025
Malicious code in cluster-lightyear-grus-public (npm)
- Aug 14, 2025
Malicious code in cluster-entanglement-update-spectroscopy (npm)
- Aug 14, 2025
Malicious code in cluster-easy-sed-throw-cloud (npm)
- Aug 14, 2025
Malicious code in cluster-babel-apollo-cors (npm)
- Aug 14, 2025
Malicious code in cluster-avior-norma-gravity (npm)
- Aug 14, 2025
Malicious code in clupda (npm)
- Aug 14, 2025
Malicious code in clunit (npm)
- Aug 14, 2025
Malicious code in cluep-express-middleware (npm)
- Aug 14, 2025
Malicious code in clubapp (npm)
- Aug 14, 2025
Malicious code in clradio (npm)
- Aug 14, 2025
Malicious code in cloudwatch2slack (npm)
- Aug 14, 2025
Malicious code in CloudStore (npm)
- Aug 14, 2025
Malicious code in cloudmsc (npm)
- Aug 14, 2025
Malicious code in cloudlet (npm)
- Aug 14, 2025
Malicious code in cloudkid (npm)
- Aug 14, 2025
Malicious code in cloudipsp (npm)
- Aug 14, 2025
Malicious code in cloudinary-url-builder (npm)
- Aug 14, 2025
Malicious code in cloudflare_ruby (npm)
- Aug 14, 2025
Malicious code in cloudera-manager-client (npm)
- Aug 14, 2025
Malicious code in cloudcarl (npm)
- Aug 14, 2025
Malicious code in cloud_storage_utils (npm)
- Aug 14, 2025
Malicious code in cloud-zebra-xbd230-project (npm)
- Aug 14, 2025
Malicious code in cloud-yeti-dpf049-project (npm)
- Aug 14, 2025
Malicious code in cloud-yawn-xfs533-project (npm)
Page 5647 of 6,634