Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
366,284 total · sorted newest first- Aug 14, 2025
Malicious code in metronavi (npm)
- Aug 14, 2025
Malicious code in metroc (npm)
- Aug 14, 2025
Malicious code in metroapps (npm)
- Aug 14, 2025
Malicious code in metoer (npm)
- Aug 14, 2025
Malicious code in metodi (npm)
- Aug 14, 2025
Malicious code in methodify (npm)
- Aug 14, 2025
Malicious code in meterup (npm)
- Aug 14, 2025
Malicious code in metero (npm)
- Aug 14, 2025
Malicious code in meteorr (npm)
- Aug 14, 2025
Malicious code in meteor-yonder-soap-hermes (npm)
- Aug 14, 2025
Malicious code in meteor-weywot-transhumanism-luna (npm)
- Aug 14, 2025
Malicious code in meteor-ursa-element-ui-supercluster (npm)
- Aug 14, 2025
Malicious code in meteor-titan-kgdw (npm)
- Aug 14, 2025
Malicious code in meteor-pyxis-semantic-ui-lint (npm)
- Aug 14, 2025
Malicious code in meteor-nova-cosmochemistry-void (npm)
- Aug 14, 2025
Malicious code in meteor-kiwi-6l1d (npm)
- Aug 14, 2025
Malicious code in meteor-kinetic-procyon-vega (npm)
- Aug 14, 2025
Malicious code in meteor-iceberg-skjw (npm)
- Aug 14, 2025
Malicious code in meteor-iceberg-96hh (npm)
- Aug 14, 2025
Malicious code in meteor-horseradish-y0mv (npm)
- Aug 14, 2025
Malicious code in meteor-fomalhaut-izar-sass-loader (npm)
- Aug 14, 2025
Malicious code in meteor-dock-9raw (npm)
- Aug 14, 2025
Malicious code in meteor-delphinus-sirius-stratigraphy (npm)
- Aug 14, 2025
Malicious code in meteor-commitlint-meteor-biosignature (npm)
- Aug 14, 2025
Malicious code in meteor-cherry-9fhd (npm)
- Aug 14, 2025
Malicious code in meteor-beetroot-ha6w (npm)
- Aug 14, 2025
Malicious code in meteor-asteroid-zsg0 (npm)
- Aug 14, 2025
Malicious code in metaoffice-documentation (npm)
- Aug 14, 2025
Malicious code in metamssk (npm)
- Aug 14, 2025
Malicious code in metamsk (npm)
- Aug 14, 2025
Malicious code in metamaks (npm)
- Aug 14, 2025
Malicious code in metalz (npm)
- Aug 14, 2025
Malicious code in metalsmith-sociobiology-steganography-cluster (npm)
- Aug 14, 2025
Malicious code in metalsmith-janus-javascript-transport (npm)
- Aug 14, 2025
Malicious code in metalsmith-grus-less-loader-gridsome (npm)
- Aug 14, 2025
Malicious code in metal-js-client (npm)
- Aug 14, 2025
Malicious code in metagenda (npm)
- Aug 14, 2025
Malicious code in metadata-ipfs-pack (npm)
2 compromised versions
- Aug 14, 2025
Malicious code in metacpan (npm)
- Aug 14, 2025
Malicious code in metacoin-box (npm)
- Aug 14, 2025
Malicious code in metabolomics-server-slides-biogeochemistry (npm)
- Aug 14, 2025
Malicious code in metabolomics-ethology-pegasus-kronos (npm)
- Aug 14, 2025
Malicious code in metabolomics-configstore-xenos-spawn (npm)
- Aug 14, 2025
Malicious code in metabolomics-boson-orogeny-oortcloud (npm)
- Aug 14, 2025
Malicious code in metabolomics-axios-webdriver-mocha-ethology (npm)
- Aug 14, 2025
Malicious code in metabolomics-apollo-brane-thermochronology (npm)
- Aug 14, 2025
Malicious code in meta_api (npm)
- Aug 14, 2025
Malicious code in meta-notify-rain-cat-fast (npm)
- Aug 14, 2025
Malicious code in meta-link-load-earth-parse (npm)
- Aug 14, 2025
Malicious code in meta-error-secure-encode-refactor (npm)
Page 5929 of 7,326