Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in bls-slack-service (npm)
- Aug 14, 2025
Malicious code in blossom_n17hq_gzml8_keystone (npm)
- Aug 14, 2025
Malicious code in blossom-yoxj7-jnwfi-frost-project (npm)
- Aug 14, 2025
Malicious code in blossom-xylophone-nlq687-project (npm)
- Aug 14, 2025
Malicious code in blossom-xenon-dcp764-project (npm)
- Aug 14, 2025
Malicious code in blossom-willow-sws030-project (npm)
- Aug 14, 2025
Malicious code in blossom-waterfall-qji119-project (npm)
- Aug 14, 2025
Malicious code in blossom-violet-gjk786-project (npm)
- Aug 14, 2025
Malicious code in blossom-tornado-ljs889-project (npm)
- Aug 14, 2025
Malicious code in blossom-spruce-mwv729-project (npm)
- Aug 14, 2025
Malicious code in blossom-nimbus-shv514-project (npm)
- Aug 14, 2025
Malicious code in blossom-meadow-hbj946-project (npm)
- Aug 14, 2025
Malicious code in blossom-lava-nyf843-project (npm)
- Aug 14, 2025
Malicious code in blossom-lagoon-zqs580-project (npm)
- Aug 14, 2025
Malicious code in blossom-kiwi-wrc666-project (npm)
- Aug 14, 2025
Malicious code in blossom-kiwi-sli430-project (npm)
- Aug 14, 2025
Malicious code in blossom-jellyfish-qij313-project (npm)
- Aug 14, 2025
Malicious code in blossom-hedgehog-lyc455-project (npm)
- Aug 14, 2025
Malicious code in blossom-desert-ckg410-project (npm)
- Aug 14, 2025
Malicious code in blossom-6irbq-xky0r-crescent-project (npm)
- Aug 14, 2025
Malicious code in blossom-3yjfq-apy5h-quasar-project (npm)
- Aug 14, 2025
Malicious code in bloomr (npm)
- Aug 14, 2025
Malicious code in bloom_v4crt_u2uue_solstice (npm)
- Aug 14, 2025
Malicious code in bloom_oovu9_v4drv_karma (npm)
- Aug 14, 2025
Malicious code in bloom_nqdkl_h0tfq_xylophone (npm)
- Aug 14, 2025
Malicious code in bloom_ih7qq_k3iej_kale (npm)
- Aug 14, 2025
Malicious code in bloom_95v7z_ewa3h_elephant (npm)
- Aug 14, 2025
Malicious code in bloom_7gr9h_jokyj_flare (npm)
- Aug 14, 2025
Malicious code in bloom_78bzk_aymzu_pine (npm)
- Aug 14, 2025
Malicious code in bloom-web (npm)
- Aug 14, 2025
Malicious code in bloom-lang (npm)
- Aug 14, 2025
Malicious code in blogyanis (npm)
- Aug 14, 2025
Malicious code in blogspine (npm)
- Aug 14, 2025
Malicious code in blogpcs (npm)
- Aug 14, 2025
Malicious code in bloging (npm)
- Aug 14, 2025
Malicious code in blogiest (npm)
- Aug 14, 2025
Malicious code in bloggap (npm)
- Aug 14, 2025
Malicious code in blog-post-prisma-middleware-cls-hooked (npm)
- Aug 14, 2025
Malicious code in bloemberg (npm)
- Aug 14, 2025
Malicious code in blockurl (npm)
- Aug 14, 2025
Malicious code in blocksqt (npm)
- Aug 14, 2025
Malicious code in blockplus (npm)
- Aug 14, 2025
Malicious code in blockly-test (npm)
- Aug 14, 2025
Malicious code in blockheads (npm)
- Aug 14, 2025
Malicious code in blockchain-components (npm)
- Aug 14, 2025
Malicious code in blockblog (npm)
- Aug 14, 2025
Malicious code in block-pattern-explorer (npm)
- Aug 14, 2025
Malicious code in block-chain (npm)
- Aug 14, 2025
Malicious code in bloccit (npm)
- Aug 14, 2025
Malicious code in blobico (npm)
Page 5674 of 6,634