Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,378 total · sorted newest first- Aug 14, 2025
Malicious code in stukdonew (npm)
- Aug 14, 2025
Malicious code in studyflip (npm)
- Aug 14, 2025
Malicious code in studo-services (npm)
- Aug 14, 2025
Malicious code in studgod (npm)
- Aug 14, 2025
Malicious code in student-competition (npm)
- Aug 14, 2025
Malicious code in stub-cat-good-quick-sigma (npm)
- Aug 14, 2025
Malicious code in stub-alpha-sed-transpile-cold (npm)
- Aug 14, 2025
Malicious code in struktor (npm)
- Aug 14, 2025
Malicious code in structured-event-logger (npm)
- Aug 14, 2025
Malicious code in structure-page-kitchen (npm)
- Aug 14, 2025
Malicious code in strssapp (npm)
- Aug 14, 2025
Malicious code in stringsx (npm)
- Aug 14, 2025
Malicious code in string-tethys-eleventy-astroinformatics (npm)
- Aug 14, 2025
Malicious code in string-template-extractor (npm)
- Aug 14, 2025
Malicious code in string-neuromorphic-ursa-alphard (npm)
- Aug 14, 2025
Malicious code in string-magnetosphere-webdriver-mocha-uglify-js (npm)
- Aug 14, 2025
Malicious code in string-letter-bee (npm)
- Aug 14, 2025
Malicious code in string-book-char-protected-deploy (npm)
- Aug 14, 2025
Malicious code in string-await-bad-uglify-small (npm)
- Aug 14, 2025
Malicious code in strictor (npm)
- Aug 14, 2025
Malicious code in stricto-helper (npm)
- Aug 14, 2025
Malicious code in strict-null-check-migration-tools (npm)
- Aug 14, 2025
Malicious code in striation (npm)
- Aug 14, 2025
Malicious code in streamrec (npm)
- Aug 14, 2025
Malicious code in streammebot (npm)
- Aug 14, 2025
Malicious code in streaming-grid (npm)
- Aug 14, 2025
Malicious code in streambox-client (npm)
- Aug 14, 2025
Malicious code in stream-weywot-postcss-loader-version (npm)
- Aug 14, 2025
Malicious code in stream-uglify-js-aldebaran-framework (npm)
- Aug 14, 2025
Malicious code in stream-polaris-andromeda-cz-conventional-changelog (npm)
- Aug 14, 2025
Malicious code in stream-manager (npm)
- Aug 14, 2025
Malicious code in stream-format (npm)
- Aug 14, 2025
Malicious code in stream-fermiparadox-scripts-update (npm)
- Aug 14, 2025
Malicious code in strax-utils (npm)
- Aug 14, 2025
Malicious code in strawberry-z3p-project (npm)
- Aug 14, 2025
Malicious code in strawberry-xigua-ugli-bdkfn (npm)
- Aug 14, 2025
Malicious code in strawberry-watermelon-ctlf (npm)
- Aug 14, 2025
Malicious code in strawberry-vy9-project (npm)
- Aug 14, 2025
Malicious code in strawberry-vq8-project (npm)
- Aug 14, 2025
Malicious code in strawberry-victor-lemon-lsemj (npm)
- Aug 14, 2025
Malicious code in strawberry-viaduct-rk25 (npm)
- Aug 14, 2025
Malicious code in strawberry-vanilla-nvel (npm)
- Aug 14, 2025
Malicious code in strawberry-uxf-project (npm)
- Aug 14, 2025
Malicious code in strawberry-uniform-victor-qpbso (npm)
- Aug 14, 2025
Malicious code in strawberry-tango-lemon-nkjcp (npm)
- Aug 14, 2025
Malicious code in strawberry-tangerine-tyjf (npm)
- Aug 14, 2025
Malicious code in strawberry-tangerine-ndxa (npm)
- Aug 14, 2025
Malicious code in strawberry-sierra-zqil (npm)
- Aug 14, 2025
Malicious code in strawberry-sierra-apple-hxcbq (npm)
- Aug 14, 2025
Malicious code in strawberry-romeo-lkgx (npm)
Page 5774 of 7,328