Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,300 total · sorted newest first- Aug 14, 2025
Malicious code in nft-collection-generator-nft-collection383 (npm)
- Aug 14, 2025
Malicious code in nft-art-generator-nft-collection989 (npm)
- Aug 14, 2025
Malicious code in nft-art-generator-nft-collection980 (npm)
- Aug 14, 2025
Malicious code in nft-art-generator-nft-collection928 (npm)
- Aug 14, 2025
Malicious code in nft-art-generator-nft-collection858 (npm)
- Aug 14, 2025
Malicious code in nft-art-generator-nft-collection741 (npm)
- Aug 14, 2025
Malicious code in nft-art-generator-nft-collection739 (npm)
- Aug 14, 2025
Malicious code in nft-art-generator-nft-collection728 (npm)
- Aug 14, 2025
Malicious code in nft-art-generator-nft-collection283 (npm)
- Aug 14, 2025
Malicious code in nft-art-generator-nft-collection026 (npm)
- Aug 14, 2025
Malicious code in nfsshell (npm)
- Aug 14, 2025
Malicious code in nflx-access (npm)
- Aug 14, 2025
Malicious code in nfcreplay (npm)
- Aug 14, 2025
Malicious code in nfcpcd (npm)
- Aug 14, 2025
Malicious code in nf-deploy (npm)
- Aug 14, 2025
Malicious code in nf-cl-schema-ui (npm)
- Aug 14, 2025
Malicious code in neznamto (npm)
- Aug 14, 2025
Malicious code in nexway (npm)
- Aug 14, 2025
Malicious code in nexus-ui-plugin (npm)
- Aug 14, 2025
Malicious code in nextrelic (npm)
- Aug 14, 2025
Malicious code in nextla (npm)
- Aug 14, 2025
Malicious code in nextjs-vega-tailwindcss-europa (npm)
- Aug 14, 2025
Malicious code in nextjs-upgrade-pulsar-bunyan (npm)
- Aug 14, 2025
Malicious code in nextjs-transform-blazar-procyon (npm)
- Aug 14, 2025
Malicious code in nextjs-thuban-terraforming-stop (npm)
- Aug 14, 2025
Malicious code in nextjs-surya (npm)
- Aug 14, 2025
Malicious code in nextjs-nconf-centauri-middleware (npm)
- Aug 14, 2025
Malicious code in nextjs-maling (npm)
- Aug 14, 2025
Malicious code in nextjs-indus-hugo-asthenosphere (npm)
- Aug 14, 2025
Malicious code in nextjs-fornax-iota-photon (npm)
- Aug 14, 2025
Malicious code in nextjs-default (npm)
3 compromised versions
- Aug 14, 2025
Malicious code in nextjs-cosmos-spinner-auth0 (npm)
- Aug 14, 2025
Malicious code in nextcapital-front (npm)
- Aug 14, 2025
Malicious code in next-time (npm)
- Aug 14, 2025
Malicious code in next-swc-win32-x64-msvc (npm)
- Aug 14, 2025
Malicious code in next-styles (npm)
- Aug 14, 2025
Malicious code in nexo-solidity-smart-contracts (npm)
- Aug 14, 2025
Malicious code in nexmann (npm)
- Aug 14, 2025
Malicious code in nexdmygwtklfjruo (npm)
- Aug 14, 2025
Malicious code in newznzb (npm)
- Aug 14, 2025
Malicious code in newtweets (npm)
- Aug 14, 2025
Malicious code in newtspeed (npm)
- Aug 14, 2025
Malicious code in newtopic (npm)
- Aug 14, 2025
Malicious code in newton-logger (npm)
- Aug 14, 2025
Malicious code in newstat (npm)
- Aug 14, 2025
Malicious code in newslot2025 (npm)
- Aug 14, 2025
Malicious code in news-vj-developer-scaffold (npm)
- Aug 14, 2025
Malicious code in newres (npm)
- Aug 14, 2025
Malicious code in newrep (npm)
- Aug 14, 2025
Malicious code in newpipi (npm)
Page 5906 of 7,326