Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in cb-components (npm)
- Aug 14, 2025
Malicious code in cavewars (npm)
- Aug 14, 2025
Malicious code in cavalry-logger (npm)
- Aug 14, 2025
Malicious code in cattoys (npm)
- Aug 14, 2025
Malicious code in catsear (npm)
- Aug 14, 2025
Malicious code in catsdogs (npm)
- Aug 14, 2025
Malicious code in catrecord (npm)
- Aug 14, 2025
Malicious code in catlnmp (npm)
- Aug 14, 2025
Malicious code in caterpillar-example (npm)
- Aug 14, 2025
Malicious code in CategoryJS (npm)
- Aug 14, 2025
Malicious code in categorize-files (npm)
- Aug 14, 2025
Malicious code in catech (npm)
- Aug 14, 2025
Malicious code in catch-secure-user-benchmark-scale (npm)
- Aug 14, 2025
Malicious code in catbox-sqlserver (npm)
- Aug 14, 2025
Malicious code in catalogus (npm)
- Aug 14, 2025
Malicious code in catalano (npm)
- Aug 14, 2025
Malicious code in cat-yeti-lzv426-project (npm)
- Aug 14, 2025
Malicious code in cat-xerus-wui769-project (npm)
- Aug 14, 2025
Malicious code in cat-xerox-mjs874-project (npm)
- Aug 14, 2025
Malicious code in cat-wisp-gib542-project (npm)
- Aug 14, 2025
Malicious code in cat-whirlpool-mhx700-project (npm)
- Aug 14, 2025
Malicious code in cat-undertow-nlw175-project (npm)
- Aug 14, 2025
Malicious code in cat-sunset-moo712-project (npm)
- Aug 14, 2025
Malicious code in cat-quagmire-zok537-project (npm)
- Aug 14, 2025
Malicious code in cat-nautilus-aou981-project (npm)
- Aug 14, 2025
Malicious code in cat-gorge-doe917-project (npm)
- Aug 14, 2025
Malicious code in cat-etc-passwd (npm)
- Aug 14, 2025
Malicious code in cat-cherry-ehk154-project (npm)
- Aug 14, 2025
Malicious code in cat-arctic-vcq912-project (npm)
- Aug 14, 2025
Malicious code in castor-server-phoebe-remark (npm)
- Aug 14, 2025
Malicious code in castor-sagitta-rollup-rate-limiter (npm)
- Aug 14, 2025
Malicious code in castor-carpo-glaciology-comet (npm)
- Aug 14, 2025
Malicious code in castle-ziggurat-oomb (npm)
- Aug 14, 2025
Malicious code in castle-sierra-phsm (npm)
- Aug 14, 2025
Malicious code in castle-oak-7ygn (npm)
- Aug 14, 2025
Malicious code in castle-jalapeno-yfi1 (npm)
- Aug 14, 2025
Malicious code in castle-harbor-qg4r (npm)
- Aug 14, 2025
Malicious code in castle-foxtrot-gsgq (npm)
- Aug 14, 2025
Malicious code in castle-beetroot-fhwq (npm)
- Aug 14, 2025
Malicious code in castillor (npm)
- Aug 14, 2025
Malicious code in castdemo (npm)
- Aug 14, 2025
Malicious code in cassini-webdriver-manager-betelgeuse-fornax (npm)
- Aug 14, 2025
Malicious code in cassini-ursa-sass-loader-stream (npm)
- Aug 14, 2025
Malicious code in cassini-public-typeorm-lepton (npm)
- Aug 14, 2025
Malicious code in cassini-hydra-request-fetch (npm)
- Aug 14, 2025
Malicious code in cassback (npm)
- Aug 14, 2025
Malicious code in casper-runner (npm)
- Aug 14, 2025
Malicious code in casknevgxulpodjm (npm)
- Aug 14, 2025
Malicious code in casino2025 (npm)
- Aug 14, 2025
Malicious code in cashup (npm)
Page 5658 of 6,634