Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Aug 14, 2025
Malicious code in aws-async-iam (npm)
- Aug 14, 2025
Malicious code in aws-api-gateway-js-client (npm)
- Aug 14, 2025
Malicious code in awkkoans (npm)
- Aug 14, 2025
Malicious code in awk-web-catch-double-compile (npm)
- Aug 14, 2025
Malicious code in awk-serialize-upsilon-web-yaml (npm)
- Aug 14, 2025
Malicious code in awk-node-decompress-process-fire (npm)
- Aug 14, 2025
Malicious code in awesomeos (npm)
- Aug 14, 2025
Malicious code in awesomec (npm)
- Aug 14, 2025
Malicious code in awesome-icon (npm)
- Aug 14, 2025
Malicious code in await-pavo-glaciology-axios (npm)
- Aug 14, 2025
Malicious code in await-lynx-scripts-superagent (npm)
- Aug 14, 2025
Malicious code in await-error-runtime-wind-gamma (npm)
- Aug 14, 2025
Malicious code in avrtest (npm)
- Aug 14, 2025
Malicious code in avrnetio (npm)
- Aug 14, 2025
Malicious code in avosjfort (npm)
- Aug 14, 2025
Malicious code in avoncr (npm)
- Aug 14, 2025
Malicious code in AVNjs (npm)
- Aug 14, 2025
Malicious code in avior-stop-xml-version (npm)
- Aug 14, 2025
Malicious code in avior-halley-postgres-lynx (npm)
- Aug 14, 2025
Malicious code in avior-cygnus-borealis-acamar (npm)
- Aug 14, 2025
Malicious code in avior-chai-html-webpack-plugin-pegasus (npm)
- Aug 14, 2025
Malicious code in avior-antares-update-bunyan (npm)
- Aug 14, 2025
Malicious code in avior-antares-adonis-websockets (npm)
- Aug 14, 2025
Malicious code in aviation-scrapper (npm)
- Aug 14, 2025
Malicious code in avgviewer (npm)
- Aug 14, 2025
Malicious code in avgmaker (npm)
- Aug 14, 2025
Malicious code in avertixjs (npm)
- Aug 14, 2025
Malicious code in averaged (npm)
- Aug 14, 2025
Malicious code in avantech-app-commons (npm)
- Aug 14, 2025
Malicious code in avantech-api-commons (npm)
- Aug 14, 2025
Malicious code in avancore (npm)
- Aug 14, 2025
Malicious code in avalon-util-plugin (npm)
- Aug 14, 2025
Malicious code in avalon-util-cli (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-xmlhttprequest (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-websocket (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-ui (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-studio (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-spine (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-socketio (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-reload (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-physics3d (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-opengl (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-navmesh (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-files (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-extension (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-experimental-video (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-chipmunk (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-builder (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-3d-extension (npm)
- Aug 14, 2025
Malicious code in avalon-plugin-3d (npm)
Page 5687 of 6,634