Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in camcuts (npm)
- Aug 14, 2025
Malicious code in camada (npm)
- Aug 14, 2025
Malicious code in cam-isol (npm)
- Aug 14, 2025
Malicious code in cam-capture (npm)
- Aug 14, 2025
Malicious code in calserver (npm)
- Aug 14, 2025
Malicious code in calphy (npm)
- Aug 14, 2025
Malicious code in calotescu (npm)
- Aug 14, 2025
Malicious code in calm-wander-cxx597-project (npm)
- Aug 14, 2025
Malicious code in calm-ponder-ufs454-project (npm)
- Aug 14, 2025
Malicious code in callnotes (npm)
- Aug 14, 2025
Malicious code in callisto-subscription-selenology-cybernetics (npm)
- Aug 14, 2025
Malicious code in callisto-playwright-chariklo-exoplanet (npm)
- Aug 14, 2025
Malicious code in callin (npm)
- Aug 14, 2025
Malicious code in callback_test_package (npm)
- Aug 14, 2025
Malicious code in callback-oberon-framework-magellan (npm)
- Aug 14, 2025
Malicious code in callback-kardashevscale-dynamo-hyperion (npm)
- Aug 14, 2025
Malicious code in callback-elektra-carpo-ini (npm)
- Aug 14, 2025
Malicious code in callback-cross-env-technosignature-ganymede (npm)
- Aug 14, 2025
Malicious code in callback-cache-1 (npm)
- Aug 14, 2025
Malicious code in callback-apex-ursa-toml (npm)
- Aug 14, 2025
Malicious code in call-center-web-client (npm)
- Aug 14, 2025
Malicious code in call-all (npm)
- Aug 14, 2025
Malicious code in calk (npm)
- Aug 14, 2025
Malicious code in calico-experience (npm)
- Aug 14, 2025
Malicious code in calendar-widget (npm)
- Aug 14, 2025
Malicious code in calderan (npm)
- Aug 14, 2025
Malicious code in calcultor (npm)
- Aug 14, 2025
Malicious code in calctw (npm)
- Aug 14, 2025
Malicious code in calcool (npm)
- Aug 14, 2025
Malicious code in calcom-monorepo (npm)
- Aug 14, 2025
Malicious code in calclash (npm)
- Aug 14, 2025
Malicious code in caladeen (npm)
- Aug 14, 2025
Malicious code in caladan (npm)
- Aug 14, 2025
Malicious code in cal_rd (npm)
- Aug 14, 2025
Malicious code in cakesns (npm)
- Aug 14, 2025
Malicious code in cakesista (npm)
- Aug 14, 2025
Malicious code in cakemail-ui-bootstrap (npm)
- Aug 14, 2025
Malicious code in cakemail-import (npm)
- Aug 14, 2025
Malicious code in cakelinge (npm)
- Aug 14, 2025
Malicious code in caitrang (npm)
- Aug 14, 2025
Malicious code in cairogles (npm)
- Aug 14, 2025
Malicious code in cahserver (npm)
- Aug 14, 2025
Malicious code in cahnrs (npm)
- Aug 14, 2025
Malicious code in cahlk (npm)
- Aug 14, 2025
Malicious code in cage-js (npm)
- Aug 14, 2025
Malicious code in caeruleum (npm)
- Aug 14, 2025
Malicious code in cadnz9mkfcvvkkzrs93jcelc1ubphrn0 (npm)
- Aug 14, 2025
Malicious code in caching-framework (npm)
- Aug 14, 2025
Malicious code in cacheondb (npm)
- Aug 14, 2025
Malicious code in cache-table-cloud-encrypt-reject (npm)
Page 5662 of 6,634