Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,378 total · sorted newest first- Aug 14, 2025
Malicious code in suepluxie (npm)
1 compromised version
- Aug 14, 2025
Malicious code in sudoesiee (npm)
- Aug 14, 2025
Malicious code in sudo-resolve-deserialize-file-cloud (npm)
- Aug 14, 2025
Malicious code in sudo-hash-hash-public-void (npm)
- Aug 14, 2025
Malicious code in sudo-compile-visualize-rho-fast (npm)
- Aug 14, 2025
Malicious code in suddenly-tin-proud (npm)
- Aug 14, 2025
Malicious code in sucscss (npm)
- Aug 14, 2025
Malicious code in subverse (npm)
- Aug 14, 2025
Malicious code in subtitles-cli (npm)
- Aug 14, 2025
Malicious code in substuff (npm)
- Aug 14, 2025
Malicious code in substance-thrown-pair (npm)
- Aug 14, 2025
Malicious code in subscription-void-sirius-kardashevscale (npm)
- Aug 14, 2025
Malicious code in subscription-virgo-cosmiconfig-nodemon (npm)
- Aug 14, 2025
Malicious code in subscription-futurology-transform-parcel (npm)
- Aug 14, 2025
Malicious code in subscription-cross-env-dione-protractor (npm)
- Aug 14, 2025
Malicious code in submarino (npm)
- Aug 14, 2025
Malicious code in sublimation-toml-cluster-gridsome (npm)
- Aug 14, 2025
Malicious code in sublimation-semantic-ui-enif-react-bootstrap (npm)
- Aug 14, 2025
Malicious code in sublimation-radiant-less-loader-ablation (npm)
- Aug 14, 2025
Malicious code in sublimation-ionosphere-quasar-darkmatter (npm)
- Aug 14, 2025
Malicious code in sublimation-docusaurus-hermes-avior (npm)
- Aug 14, 2025
Malicious code in sublimation-astroinformatics-mineralogy-rimraf (npm)
- Aug 14, 2025
Malicious code in subliime (npm)
- Aug 14, 2025
Malicious code in subduction-pulsar-markdownlint-pino-pretty (npm)
- Aug 14, 2025
Malicious code in subduction-node-config-event-browserify (npm)
- Aug 14, 2025
Malicious code in subduction-nestjs-supercluster-norma (npm)
- Aug 14, 2025
Malicious code in subduction-nconf-prosthetics-nebula (npm)
- Aug 14, 2025
Malicious code in subduction-mira-scripts-mongoose (npm)
- Aug 14, 2025
Malicious code in subduction-exec-mutation-betelgeuse (npm)
- Aug 14, 2025
Malicious code in subcrunch (npm)
- Aug 14, 2025
Malicious code in suanfas (npm)
- Aug 14, 2025
Malicious code in suaneotvrcpqjyxk (npm)
- Aug 14, 2025
Malicious code in stynbb (npm)
- Aug 14, 2025
Malicious code in stylelint-polaris (npm)
- Aug 14, 2025
Malicious code in stylelint-function-url-no-domain (npm)
- Aug 14, 2025
Malicious code in stylelint-config-toolbox (npm)
- Aug 14, 2025
Malicious code in stylelint-config-edx (npm)
- Aug 14, 2025
Malicious code in stylelint-config-data-ui (npm)
- Aug 14, 2025
Malicious code in styled-jsx-plugin-sass-2 (npm)
- Aug 14, 2025
Malicious code in style-loader-spectroscopy-nova-browserify (npm)
- Aug 14, 2025
Malicious code in style-loader-server-epimetheus-dotenv-safe (npm)
- Aug 14, 2025
Malicious code in style-loader-nextjs-css-loader-gemini (npm)
- Aug 14, 2025
Malicious code in style-loader-link-umbriel-wasat (npm)
- Aug 14, 2025
Malicious code in style-loader-elara-protractor-csrf (npm)
- Aug 14, 2025
Malicious code in style-loader-bellatrix-registry-alphard (npm)
- Aug 14, 2025
Malicious code in style-format (npm)
- Aug 14, 2025
Malicious code in style-dom (npm)
- Aug 14, 2025
Malicious code in style-console (npm)
- Aug 14, 2025
Malicious code in stuxnet (npm)
- Aug 14, 2025
Malicious code in stutters (npm)
Page 5773 of 7,328