Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,073 total in npm · sorted newest first- May 28, 2026
Malicious code in @cloudplatform-single-spa/ml-ai-agents-agent-system (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/ml-ai-agents-agent (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/marketplace-main (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/marketplace-gigachat (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/marketplace-apps (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/managed-identities (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/magic-router (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/magic-bridge (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/logaas (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/key-manager (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/installations (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/iam (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/floating-ips (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/evolution (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/evocs (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/event-bus (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/enterprise (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/employees (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/edge-manager (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/document-db (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/dns (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/disks (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/dataplatform-trino (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/dataplatform-spark (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/dataplatform-nessie (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/dataplatform-metastore (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/dataplatform-flink (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/dataplatform-connections (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/dataplatform-clusters (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/dataplatform-cloudberry (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/dataplatform-bi (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/dataplatform (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/datagrid (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/cp-api-gw (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/corax (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/container-registry (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/cnapp-ui (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/cloudia (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/cloud-dns (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/clickhouse (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/certificate-manager (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/business-solutions (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/billing (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/base-static-page (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/bare-metal-servers (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/audit-log (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/arenadata-db (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/anti-ddos (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/airflow (npm)
- May 28, 2026
Malicious code in @cloudplatform-single-spa/aifactory-notebooks (npm)
Page 75 of 4,802