Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,576 total · sorted newest first- Sep 17, 2026
Malicious code in library-transport-iota-arcturus (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-petrology-grunt-sedna (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlfinal4 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libusby (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlfinal3 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-pavo-impulse-andromeda (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libxmlaboba (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-prettier-plugin-markdown-alphard-betelgeuse (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-prettier-stylelint-semantic-release-centauri (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libsord (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-metalsmith-apollo-protractor (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-volcanology-magnetosphere-foundation (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-bellatrix-cli-cors (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libnfc (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liblcdgr (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-babel-meteor-kronos (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libhbaapi (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libnpmpublishing (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-magellan-telesto-mira (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-commitizen-webdriver-manager-neptunology (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-frontend-update-eclipse (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libmap (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-kronos-start-ceres (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-eleventy-start-semantic-release (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liberal_tyrannosaurus-smiletea (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libpnpmpublish (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libjs-cqs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libparty (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-chai-carina-nuxtjs (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-cassini-apollo-request (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-fetch-hyperion-vortex (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libfluid (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libi-common (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liberal_takin_indigo-2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-archaeoastronomy-winston-spica (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-apollo-sagitta-relay (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-init-flare-pm2 (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-fornax-start-yaml (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-betelgeuse-yonder-scorpius (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-alphard-nova-planetology (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-dotenv-safe-gridsome-singularity (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libpostcss (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-markdown-proxima-cluster (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-ganymede-axios-phoebe (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liberal_sparrow_z3n (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libnpmpublisher (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-loop-centaurus-request (npm)
1 compromised version
- Sep 17, 2026
Malicious code in liboccam (npm)
1 compromised version
- Sep 17, 2026
Malicious code in libhid (npm)
1 compromised version
- Sep 17, 2026
Malicious code in library-biosignature-bionics-mocha (npm)
1 compromised version
Page 128 of 7,312