Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in charlie-november-alpha-zvrry (npm)
- Aug 14, 2025
Malicious code in charlie-mike-victor-taetl (npm)
- Aug 14, 2025
Malicious code in charlie-mike-alpha-mvvyr (npm)
- Aug 14, 2025
Malicious code in charlie-lby-project (npm)
- Aug 14, 2025
Malicious code in charlie-l49-project (npm)
- Aug 14, 2025
Malicious code in charlie-kiwi-ldve (npm)
- Aug 14, 2025
Malicious code in charlie-kiwi-camx (npm)
- Aug 14, 2025
Malicious code in charlie-kilo-oddi (npm)
- Aug 14, 2025
Malicious code in charlie-jus-project (npm)
- Aug 14, 2025
Malicious code in charlie-india-fmij (npm)
- Aug 14, 2025
Malicious code in charlie-hr8-project (npm)
- Aug 14, 2025
Malicious code in charlie-hotel-mango-kkity (npm)
- Aug 14, 2025
Malicious code in charlie-hotel-frip (npm)
- Aug 14, 2025
Malicious code in charlie-honeydew-grape-aqviy (npm)
- Aug 14, 2025
Malicious code in charlie-honeydew-golf-hukbn (npm)
- Aug 14, 2025
Malicious code in charlie-grape-echo-eaxui (npm)
- Aug 14, 2025
Malicious code in charlie-fig-kiwi-lsgsh (npm)
- Aug 14, 2025
Malicious code in charlie-elderberry-args (npm)
- Aug 14, 2025
Malicious code in charlie-echo-u73o (npm)
- Aug 14, 2025
Malicious code in charlie-bravo-nectarine-phuzp (npm)
- Aug 14, 2025
Malicious code in charlie-9wx-project (npm)
- Aug 14, 2025
Malicious code in charlie-743-project (npm)
- Aug 14, 2025
Malicious code in charlie-5fq-project (npm)
- Aug 14, 2025
Malicious code in charlie-2eq-project (npm)
- Aug 14, 2025
Malicious code in charlie-1ua-project (npm)
- Aug 14, 2025
Malicious code in charlie-0mu-project (npm)
- Aug 14, 2025
Malicious code in chariklo-enif-rollup-plugin-paleoceanography (npm)
- Aug 14, 2025
Malicious code in charcoal-ui (npm)
- Aug 14, 2025
Malicious code in character-local (npm)
- Aug 14, 2025
Malicious code in character-authenticator (npm)
- Aug 14, 2025
Malicious code in character-authentication (npm)
- Aug 14, 2025
Malicious code in char-scale-string-object-hot (npm)
- Aug 14, 2025
Malicious code in channels-ui (npm)
- Aug 14, 2025
Malicious code in channels-patterns (npm)
- Aug 14, 2025
Malicious code in channel-o (npm)
- Aug 14, 2025
Malicious code in changelog-rest-spectron-telesto (npm)
- Aug 14, 2025
Malicious code in changelog-prosthetics-cryovolcano-comet (npm)
- Aug 14, 2025
Malicious code in changelog-fermion-less-loader-virgo (npm)
- Aug 14, 2025
Malicious code in changelog-browserify-csrf-levels (npm)
- Aug 14, 2025
Malicious code in changelog-auth-norma-loopback (npm)
- Aug 14, 2025
Malicious code in changedeparment (npm)
- Aug 14, 2025
Malicious code in changed-services (npm)
- Aug 14, 2025
Malicious code in change-object-path (npm)
- Aug 14, 2025
Malicious code in chandl (npm)
- Aug 14, 2025
Malicious code in chanceutb (npm)
- Aug 14, 2025
Malicious code in chamada (npm)
- Aug 14, 2025
Malicious code in chalq (npm)
- Aug 14, 2025
Malicious code in chalkk (npm)
- Aug 14, 2025
Malicious code in chalk2 (npm)
- Aug 14, 2025
Malicious code in chalk-winston-wolf-semantic-release (npm)
Page 5655 of 6,634