Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,285 total · sorted newest first- Aug 14, 2025
Malicious code in molecule_h2ypp_dea3s_ocean (npm)
- Aug 14, 2025
Malicious code in mojodemo (npm)
- Aug 14, 2025
Malicious code in mojo-ui-components (npm)
- Aug 14, 2025
Malicious code in mojacesta (npm)
- Aug 14, 2025
Malicious code in mogoose (npm)
- Aug 14, 2025
Malicious code in mogodb-core (npm)
- Aug 14, 2025
Malicious code in mogodb (npm)
- Aug 14, 2025
Malicious code in mogobd (npm)
- Aug 14, 2025
Malicious code in module-templates-shared-modules (npm)
- Aug 14, 2025
Malicious code in module-speleology-style-loader-singularitarianism (npm)
- Aug 14, 2025
Malicious code in module-relationship (npm)
- Aug 14, 2025
Malicious code in module-paleobotany-module-supernova (npm)
- Aug 14, 2025
Malicious code in module-name (npm)
- Aug 14, 2025
Malicious code in module-lacerta-cosmos-webdriver-mocha (npm)
- Aug 14, 2025
Malicious code in module-electron-builder-decoherence-transhumanism (npm)
- Aug 14, 2025
Malicious code in module-draft-js-mention-plugin (npm)
- Aug 14, 2025
Malicious code in module-daemon-sun-stub-lambda (npm)
- Aug 14, 2025
Malicious code in module-astro-nashira-chariklo (npm)
- Aug 14, 2025
Malicious code in modtools (npm)
- Aug 14, 2025
Malicious code in modplay (npm)
- Aug 14, 2025
Malicious code in modown-static (npm)
- Aug 14, 2025
Malicious code in modown-micro (npm)
- Aug 14, 2025
Malicious code in modown-locator (npm)
- Aug 14, 2025
Malicious code in modown-handlebars (npm)
- Aug 14, 2025
Malicious code in modeus-legacy (npm)
- Aug 14, 2025
Malicious code in modeus-core (npm)
- Aug 14, 2025
Malicious code in models-frontend (npm)
- Aug 14, 2025
Malicious code in moddel (npm)
- Aug 14, 2025
Malicious code in modcraft (npm)
- Aug 14, 2025
Malicious code in mocktail.js (npm)
- Aug 14, 2025
Malicious code in mockia (npm)
- Aug 14, 2025
Malicious code in mockerbox (npm)
- Aug 14, 2025
Malicious code in mockdeb (npm)
- Aug 14, 2025
Malicious code in mock-uglify-short-char-catch (npm)
- Aug 14, 2025
Malicious code in mock-simulate-moon-sudo-export (npm)
- Aug 14, 2025
Malicious code in mock-cloud-encrypt-gamma-dog (npm)
- Aug 14, 2025
Malicious code in mochs (npm)
- Aug 14, 2025
Malicious code in mochq (npm)
- Aug 14, 2025
Malicious code in mochikun (npm)
- Aug 14, 2025
Malicious code in mocha-sedna-server-convict (npm)
- Aug 14, 2025
Malicious code in mocha-janus-shelljs-dorado (npm)
- Aug 14, 2025
Malicious code in mocha-helios-postgres-registry (npm)
- Aug 14, 2025
Malicious code in mocha-graphql-ursa-carina (npm)
- Aug 14, 2025
Malicious code in mocha-filament-child-process-janus (npm)
- Aug 14, 2025
Malicious code in mocha-dorado-meteor-iota (npm)
- Aug 14, 2025
Malicious code in mocha-cache-cz-conventional-changelog-cosmicweb (npm)
- Aug 14, 2025
Malicious code in mobtest (npm)
- Aug 14, 2025
Malicious code in mobmonkey (npm)
- Aug 14, 2025
Malicious code in mobmap (npm)
- Aug 14, 2025
Malicious code in mobiuscore (npm)
Page 5922 of 7,326