Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Aug 14, 2025
Malicious code in op-payment-widget-v3 (npm)
- Aug 14, 2025
Malicious code in op-payment-live-validation (npm)
- Aug 14, 2025
Malicious code in op-payment-account (npm)
- Aug 14, 2025
Malicious code in op-identify-card (npm)
- Aug 14, 2025
Malicious code in ootrainer (npm)
- Aug 14, 2025
Malicious code in oortcloud-blackhole-galaxy-blackhole (npm)
- Aug 14, 2025
Malicious code in oortcloud-biohacking-oauth-cladistics (npm)
- Aug 14, 2025
Malicious code in onzu-story (npm)
- Aug 14, 2025
Malicious code in onwu2 (npm)
- Aug 14, 2025
Malicious code in ontrails (npm)
- Aug 14, 2025
Malicious code in ont-ts (npm)
- Aug 14, 2025
Malicious code in onmymind (npm)
- Aug 14, 2025
Malicious code in only-test-not-install (npm)
- Aug 14, 2025
Malicious code in onixpod (npm)
- Aug 14, 2025
Malicious code in onifixer (npm)
- Aug 14, 2025
Malicious code in onhktuwcbazvgfkr (npm)
- Aug 14, 2025
Malicious code in onfile (npm)
- Aug 14, 2025
Malicious code in onestroke (npm)
- Aug 14, 2025
Malicious code in oneshot-application-api (npm)
- Aug 14, 2025
Malicious code in oneshike (npm)
- Aug 14, 2025
Malicious code in ones-ai-web (npm)
- Aug 14, 2025
Malicious code in onepush-browser-notifications (npm)
- Aug 14, 2025
Malicious code in onedrive-verification (npm)
- Aug 14, 2025
Malicious code in onedemo (npm)
- Aug 14, 2025
Malicious code in onedata (npm)
- Aug 14, 2025
Malicious code in one-to-one-sample (npm)
- Aug 14, 2025
Malicious code in ondemand-title_page (npm)
- Aug 14, 2025
Malicious code in ondemand-settings (npm)
- Aug 14, 2025
Malicious code in ondabike (npm)
- Aug 14, 2025
Malicious code in on-middleware-pulsar-jabbah (npm)
- Aug 14, 2025
Malicious code in on-meteor-quasarjet-boson (npm)
- Aug 14, 2025
Malicious code in on-key-press (npm)
- Aug 14, 2025
Malicious code in on-impulse-gulp-abiogenesis (npm)
- Aug 14, 2025
Malicious code in on-duplex-perseus-quasar (npm)
- Aug 14, 2025
Malicious code in omnivideo (npm)
- Aug 14, 2025
Malicious code in omnirom (npm)
- Aug 14, 2025
Malicious code in omnihotel (npm)
- Aug 14, 2025
Malicious code in omniauth-shopify-oauth2 (npm)
- Aug 14, 2025
Malicious code in omnia-foundation (npm)
- Aug 14, 2025
Malicious code in omni-law-menu-section (npm)
- Aug 14, 2025
Malicious code in omicron-load-import-stub-thread (npm)
- Aug 14, 2025
Malicious code in omicron-deploy-index-bad-sun (npm)
- Aug 14, 2025
Malicious code in omgaqiujfkwblpxd (npm)
- Aug 14, 2025
Malicious code in omekadd (npm)
- Aug 14, 2025
Malicious code in omegawd (npm)
- Aug 14, 2025
Malicious code in omegacen (npm)
- Aug 14, 2025
Malicious code in omega-xml-assert-notify-iota (npm)
- Aug 14, 2025
Malicious code in omega-pipe-stub-encode-easy (npm)
- Aug 14, 2025
Malicious code in omega-old-catch-report-sanitize (npm)
- Aug 14, 2025
Malicious code in omega-cms-lf-ng-md-file-input (npm)
Page 5856 of 7,293