Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in cloud-umbra-tya835-project (npm)
- Aug 14, 2025
Malicious code in cloud-tulip-ivv088-project (npm)
- Aug 14, 2025
Malicious code in cloud-shell-getting-started (npm)
- Aug 14, 2025
Malicious code in cloud-shell-extension (npm)
- Aug 14, 2025
Malicious code in cloud-runtime-authorization (npm)
- Aug 14, 2025
Malicious code in cloud-runtime (npm)
- Aug 14, 2025
Malicious code in cloud-reef-efw601-project (npm)
- Aug 14, 2025
Malicious code in cloud-quasar-qmf033-project (npm)
- Aug 14, 2025
Malicious code in cloud-pi-signal-wind-enum (npm)
- Aug 14, 2025
Malicious code in cloud-opaline-bld350-project (npm)
- Aug 14, 2025
Malicious code in cloud-object-service (npm)
- Aug 14, 2025
Malicious code in cloud-object-new-resolve-grid (npm)
- Aug 14, 2025
Malicious code in cloud-lagoon-wgk918-project (npm)
- Aug 14, 2025
Malicious code in cloud-iota-table-pipe-catch (npm)
- Aug 14, 2025
Malicious code in cloud-image (npm)
- Aug 14, 2025
Malicious code in cloud-honey-ccq360-project (npm)
- Aug 14, 2025
Malicious code in cloud-hill-lqn834-project (npm)
- Aug 14, 2025
Malicious code in cloud-giraffe-wry163-project (npm)
- Aug 14, 2025
Malicious code in cloud-falcon-zdv650-project (npm)
- Aug 14, 2025
Malicious code in cloud-emulate-dog-benchmark-module (npm)
- Aug 14, 2025
Malicious code in cloud-arctic-djz542-project (npm)
- Aug 14, 2025
Malicious code in cloud-active (npm)
- Aug 14, 2025
Malicious code in clothnote (npm)
- Aug 14, 2025
Malicious code in closure-es6 (npm)
1 compromised version
- Aug 14, 2025
Malicious code in clonnit (npm)
- Aug 14, 2025
Malicious code in cloejb (npm)
- Aug 14, 2025
Malicious code in clocam (npm)
- Aug 14, 2025
Malicious code in cloakmy (npm)
- Aug 14, 2025
Malicious code in cljsuit (npm)
- Aug 14, 2025
Malicious code in cljsrt (npm)
- Aug 14, 2025
Malicious code in cliques-console (npm)
- Aug 14, 2025
Malicious code in cliptwo (npm)
- Aug 14, 2025
Malicious code in clips-processor (npm)
- Aug 14, 2025
Malicious code in clippboard.js (npm)
- Aug 14, 2025
Malicious code in ClipJS (npm)
- Aug 14, 2025
Malicious code in clipboard-parse (npm)
- Aug 14, 2025
Malicious code in clip_settings (npm)
- Aug 14, 2025
Malicious code in clingsii (npm)
- Aug 14, 2025
Malicious code in climas (npm)
- Aug 14, 2025
Malicious code in cliff-zenith-nwy053-project (npm)
- Aug 14, 2025
Malicious code in cliff-yak-pes843-project (npm)
- Aug 14, 2025
Malicious code in cliff-utopia-hvw531-project (npm)
- Aug 14, 2025
Malicious code in cliff-rainbow-aej248-project (npm)
- Aug 14, 2025
Malicious code in cliff-lightning-dxr913-project (npm)
- Aug 14, 2025
Malicious code in cliff-fern-kgt853-project (npm)
- Aug 14, 2025
Malicious code in cliff-falcon-whl158-project (npm)
- Aug 14, 2025
Malicious code in cliff-blossom-ige915-project (npm)
- Aug 14, 2025
Malicious code in cliff-ant-yra155-project (npm)
- Aug 14, 2025
Malicious code in clientlibs (npm)
- Aug 14, 2025
Malicious code in client-hooks-eslint-es6 (npm)
Page 5648 of 6,634