Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,303 total · sorted newest first- Aug 14, 2025
Malicious code in orange-banana-ugli-aahjr (npm)
- Aug 14, 2025
Malicious code in orange-banana-imbt (npm)
- Aug 14, 2025
Malicious code in orange-9ql-project (npm)
- Aug 14, 2025
Malicious code in orange-91b-project (npm)
- Aug 14, 2025
Malicious code in orange-8zg-project (npm)
- Aug 14, 2025
Malicious code in orange-8xd-project (npm)
- Aug 14, 2025
Malicious code in orange-7oi-project (npm)
- Aug 14, 2025
Malicious code in orange-462-project (npm)
- Aug 14, 2025
Malicious code in oracle-h5wa9-x4t03-oasis-project (npm)
- Aug 14, 2025
Malicious code in oracle-etb4u-oxccq-xenon-project (npm)
- Aug 14, 2025
Malicious code in ora-centauri-nconf-venus (npm)
- Aug 14, 2025
Malicious code in oqpbkcjedrvlfkwu (npm)
- Aug 14, 2025
Malicious code in opusdac (npm)
- Aug 14, 2025
Malicious code in optsoft (npm)
- Aug 14, 2025
Malicious code in optrun (npm)
- Aug 14, 2025
Malicious code in optimystic-hello-world (npm)
- Aug 14, 2025
Malicious code in optimize-sudo-spy-omega-error (npm)
- Aug 14, 2025
Malicious code in optimize-root-minify-long-grid (npm)
- Aug 14, 2025
Malicious code in optimize-css-assets-webpack-plugin-quantum-supervisor-oscillation (npm)
- Aug 14, 2025
Malicious code in optimize-css-assets-webpack-plugin-pulsar-inquirer-juno (npm)
- Aug 14, 2025
Malicious code in optimize-css-assets-webpack-plugin-odin-slides-izar (npm)
- Aug 14, 2025
Malicious code in optimize-css-assets-webpack-plugin-octans-eslint-config-farout (npm)
- Aug 14, 2025
Malicious code in optimize-css-assets-webpack-plugin-node-config-europa-native (npm)
- Aug 14, 2025
Malicious code in optimium (npm)
- Aug 14, 2025
Malicious code in opstools (npm)
- Aug 14, 2025
Malicious code in opstarts-ui (npm)
- Aug 14, 2025
Malicious code in opsadmin (npm)
- Aug 14, 2025
Malicious code in opress (npm)
- Aug 14, 2025
Malicious code in opiblog (npm)
- Aug 14, 2025
Malicious code in ophiuchus-whitedwarf-janus-proteomics (npm)
- Aug 14, 2025
Malicious code in ophiuchus-telesto-local-zenith (npm)
- Aug 14, 2025
Malicious code in ophiuchus-phoenix-rimraf-convict (npm)
- Aug 14, 2025
Malicious code in ophiuchus-greatfilter-delphinus-ceres (npm)
- Aug 14, 2025
Malicious code in ophiuchus-farout-yakutsk-bellatrix (npm)
- Aug 14, 2025
Malicious code in ophiuchus-cosmicray-xerxes-eslint-config (npm)
- Aug 14, 2025
Malicious code in ophiuchus-comet-wavefunction-event (npm)
- Aug 14, 2025
Malicious code in ophiuchus-backend-perseus-jabbah (npm)
- Aug 14, 2025
Malicious code in ophiuchus-aquarius-antd-meissa (npm)
- Aug 14, 2025
Malicious code in ophiuchus-algol-troposphere-dendrochronology (npm)
- Aug 14, 2025
Malicious code in openzeppelin-solidity-2.3.0 (npm)
- Aug 14, 2025
Malicious code in openwow (npm)
- Aug 14, 2025
Malicious code in openwom (npm)
- Aug 14, 2025
Malicious code in openuax (npm)
- Aug 14, 2025
Malicious code in openturf (npm)
- Aug 14, 2025
Malicious code in opentree (npm)
- Aug 14, 2025
Malicious code in opentelemetry-shopify (npm)
- Aug 14, 2025
Malicious code in opent2t-translator-com-hue-hub (npm)
- Aug 14, 2025
Malicious code in opent2t-translator-com-hue-bulb (npm)
- Aug 14, 2025
Malicious code in opent2t-onboarding-org-opent2t-onboarding-hue (npm)
- Aug 14, 2025
Malicious code in opent2t-onboarding-huehub (npm)
Page 5887 of 7,327