Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,303 total · sorted newest first- Aug 14, 2025
Malicious code in ocean-5mlhv-alzmw-quasar-project (npm)
- Aug 14, 2025
Malicious code in ocean-4v7fh-fwl2f-xanadu-project (npm)
- Aug 14, 2025
Malicious code in ocean-0x8ao-mmpa5-unity-project (npm)
- Aug 14, 2025
Malicious code in ocean-03ziy-f4gib-kale-project (npm)
- Aug 14, 2025
Malicious code in oce-login-enabler (npm)
- Aug 14, 2025
Malicious code in oce-login (npm)
- Aug 14, 2025
Malicious code in occupy-test6035 (npm)
- Aug 14, 2025
Malicious code in ocbeerxml (npm)
- Aug 14, 2025
Malicious code in ocamlmath (npm)
- Aug 14, 2025
Malicious code in ocamlfind (npm)
- Aug 14, 2025
Malicious code in ocamini (npm)
- Aug 14, 2025
Malicious code in obsunc (npm)
- Aug 14, 2025
Malicious code in obsidian_c3z8b_csv9g_daybreak (npm)
- Aug 14, 2025
Malicious code in obsidian_bbmoa_gqnlv_saffron (npm)
- Aug 14, 2025
Malicious code in obsidian_9sirt_rppgo_twilight (npm)
- Aug 14, 2025
Malicious code in obsidian_2ahmf_vbejq_wind (npm)
- Aug 14, 2025
Malicious code in obsidian-vi126-k7sjp-hearth-project (npm)
- Aug 14, 2025
Malicious code in obsidian-rm5zg-wjktt-ocean-project (npm)
- Aug 14, 2025
Malicious code in obsidian-jplel-d5lei-nymph-project (npm)
- Aug 14, 2025
Malicious code in obsidian-iumeo-ks71t-night-project (npm)
- Aug 14, 2025
Malicious code in obsidian-b763a-7h0h1-solace-project (npm)
- Aug 14, 2025
Malicious code in obsidian-9dzi7-6um2j-xenith-project (npm)
- Aug 14, 2025
Malicious code in obsidian-8d87p-e0waw-rose-project (npm)
- Aug 14, 2025
Malicious code in obsidian-1k6o4-lgj2h-dawn-project (npm)
- Aug 14, 2025
Malicious code in observu (npm)
- Aug 14, 2025
Malicious code in observed-bits (npm)
- Aug 14, 2025
Malicious code in observatory-yacht-750n (npm)
- Aug 14, 2025
Malicious code in observatory-teak-aocm (npm)
- Aug 14, 2025
Malicious code in observatory-jetty-e0m4 (npm)
- Aug 14, 2025
Malicious code in observatory-jalapeno-nkmx (npm)
- Aug 14, 2025
Malicious code in observatory-banana-ci96 (npm)
- Aug 14, 2025
Malicious code in observatory-banana-bqbu (npm)
- Aug 14, 2025
Malicious code in observatory-alpha-u7qb (npm)
- Aug 14, 2025
Malicious code in observatory-airplane-ohjh (npm)
- Aug 14, 2025
Malicious code in obscom (npm)
- Aug 14, 2025
Malicious code in obowngita (npm)
- Aug 14, 2025
Malicious code in obligb (npm)
- Aug 14, 2025
Malicious code in objektno (npm)
- Aug 14, 2025
Malicious code in object-window-dtc (npm)
- Aug 14, 2025
Malicious code in object-tools-ts (npm)
- Aug 14, 2025
Malicious code in object-table-hash-private-enum (npm)
- Aug 14, 2025
Malicious code in object-storage-service (npm)
- Aug 14, 2025
Malicious code in object-easy-route-proxy-bundle (npm)
- Aug 14, 2025
Malicious code in object-cache-dog-test-byte (npm)
- Aug 14, 2025
Malicious code in obitty (npm)
- Aug 14, 2025
Malicious code in obility (npm)
- Aug 14, 2025
Malicious code in obfuscalp (npm)
- Aug 14, 2025
Malicious code in obflex (npm)
- Aug 14, 2025
Malicious code in oberon-shelljs-build-development (npm)
- Aug 14, 2025
Malicious code in oberon-sedna-steganography-pegasus (npm)
Page 5893 of 7,327