Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in cartruck (npm)
- Aug 14, 2025
Malicious code in cartridge-gulpicon (npm)
- Aug 14, 2025
Malicious code in carto-lib-js (npm)
- Aug 14, 2025
Malicious code in cartele (npm)
- Aug 14, 2025
Malicious code in cartapush (npm)
- Aug 14, 2025
Malicious code in carspeed (npm)
- Aug 14, 2025
Malicious code in carrot-xerophyte-jhu6 (npm)
- Aug 14, 2025
Malicious code in carrot-uniform-v6ee (npm)
- Aug 14, 2025
Malicious code in carrot-ugli-jjwq (npm)
- Aug 14, 2025
Malicious code in carrot-orbit-wzn5 (npm)
- Aug 14, 2025
Malicious code in carrot-echo-k6n6 (npm)
- Aug 14, 2025
Malicious code in carpo-nodejs-react-bootstrap-hyperion (npm)
- Aug 14, 2025
Malicious code in carpo-deneb-supercluster-zenobia (npm)
- Aug 14, 2025
Malicious code in carolus (npm)
- Aug 14, 2025
Malicious code in carno-key-board (npm)
- Aug 14, 2025
Malicious code in carmesim (npm)
- Aug 14, 2025
Malicious code in carloprojectlesang (npm)
- Aug 14, 2025
Malicious code in carloprojectdiscord (npm)
- Aug 14, 2025
Malicious code in carina-wasat-css-minimizer-webpack-plugin-paleoclimatology (npm)
- Aug 14, 2025
Malicious code in carina-kardashevscale-mdx-terser (npm)
- Aug 14, 2025
Malicious code in carina-google-radiant-less-loader (npm)
- Aug 14, 2025
Malicious code in carina-cluster-dotenv-eslint-plugin (npm)
- Aug 14, 2025
Malicious code in cargolog (npm)
- Aug 14, 2025
Malicious code in caretta.cuid (npm)
- Aug 14, 2025
Malicious code in caretta-query (npm)
- Aug 14, 2025
Malicious code in caretta-identity (npm)
- Aug 14, 2025
Malicious code in carental (npm)
- Aug 14, 2025
Malicious code in cardspin (npm)
- Aug 14, 2025
Malicious code in cardinal-cors-client (npm)
- Aug 14, 2025
Malicious code in carbon-invoice (npm)
- Aug 14, 2025
Malicious code in carazel (npm)
- Aug 14, 2025
Malicious code in caravan-yonder-moy936-project (npm)
- Aug 14, 2025
Malicious code in caravan-vine-fro441-project (npm)
- Aug 14, 2025
Malicious code in caravan-thistle-jhe214-project (npm)
- Aug 14, 2025
Malicious code in caravan-sunset-snw575-project (npm)
- Aug 14, 2025
Malicious code in caravan-reef-oqj376-project (npm)
- Aug 14, 2025
Malicious code in caravan-piano-pez198-project (npm)
- Aug 14, 2025
Malicious code in caravan-koala-ibd409-project (npm)
- Aug 14, 2025
Malicious code in caravan-jasmine-aon652-project (npm)
- Aug 14, 2025
Malicious code in caravan-harbor-jcj085-project (npm)
- Aug 14, 2025
Malicious code in caravan-grove-emc436-project (npm)
- Aug 14, 2025
Malicious code in caravan-glacier-uou658-project (npm)
- Aug 14, 2025
Malicious code in caravan-fern-eev911-project (npm)
- Aug 14, 2025
Malicious code in caravan-aroma-vvu595-project (npm)
- Aug 14, 2025
Malicious code in car-watermelon-iw82 (npm)
- Aug 14, 2025
Malicious code in car-shack-phk6 (npm)
- Aug 14, 2025
Malicious code in car-rainbow-bq89 (npm)
- Aug 14, 2025
Malicious code in car-kiwi-4uc8 (npm)
- Aug 14, 2025
Malicious code in car-itsur-s22120188 (npm)
- Aug 14, 2025
Malicious code in car-igloo-ildu (npm)
Page 5660 of 6,634