Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Aug 14, 2025
Malicious code in contax (npm)
- Aug 14, 2025
Malicious code in container-private-psi-long-enum (npm)
- Aug 14, 2025
Malicious code in container-dog-omicron-beta-route (npm)
- Aug 14, 2025
Malicious code in container-await-emulate-double-orchestrate (npm)
- Aug 14, 2025
Malicious code in consumerweb-logger (npm)
- Aug 14, 2025
Malicious code in consul-peerings (npm)
- Aug 14, 2025
Malicious code in consul-partitions (npm)
- Aug 14, 2025
Malicious code in consul-lock-sessions (npm)
- Aug 14, 2025
Malicious code in consul-hcp (npm)
- Aug 14, 2025
Malicious code in consul-acls (npm)
- Aug 14, 2025
Malicious code in constant_resolver (npm)
- Aug 14, 2025
Malicious code in consolerotate (npm)
- Aug 14, 2025
Malicious code in consent_decree (npm)
- Aug 14, 2025
Malicious code in connectservice (npm)
- Aug 14, 2025
Malicious code in connected-cells (npm)
- Aug 14, 2025
Malicious code in connect-mayfly (npm)
- Aug 14, 2025
Malicious code in conmendator-api-client (npm)
- Aug 14, 2025
Malicious code in conlogmon (npm)
- Aug 14, 2025
Malicious code in conkool (npm)
- Aug 14, 2025
Malicious code in conistring (npm)
- Aug 14, 2025
Malicious code in conifer-spinach-pbtu (npm)
- Aug 14, 2025
Malicious code in congstudy (npm)
- Aug 14, 2025
Malicious code in congrs (npm)
- Aug 14, 2025
Malicious code in congqian (npm)
- Aug 14, 2025
Malicious code in confluent-examples-nodejs (npm)
- Aug 14, 2025
Malicious code in confkit-notifier-slack (npm)
- Aug 14, 2025
Malicious code in confkit-commons (npm)
- Aug 14, 2025
Malicious code in confkit-base-module-defaultheaders (npm)
- Aug 14, 2025
Malicious code in confkit-base (npm)
- Aug 14, 2025
Malicious code in confit_mod (npm)
- Aug 14, 2025
Malicious code in configure-measure (npm)
- Aug 14, 2025
Malicious code in configstore-cluster-cors-react-bootstrap (npm)
- Aug 14, 2025
Malicious code in config-stratigraphy-geochemistry-bunyan (npm)
- Aug 14, 2025
Malicious code in config-management-cli (npm)
- Aug 14, 2025
Malicious code in config-genomics-jekyll-ganymede (npm)
- Aug 14, 2025
Malicious code in config-doc (npm)
- Aug 14, 2025
Malicious code in config-command-apex-phoebe (npm)
- Aug 14, 2025
Malicious code in config-chai-publish-ganymede (npm)
- Aug 14, 2025
Malicious code in config-blackhole-xerxes-titan (npm)
- Aug 14, 2025
Malicious code in config-app (npm)
- Aug 14, 2025
Malicious code in conferer (npm)
- Aug 14, 2025
Malicious code in confbot (npm)
- Aug 14, 2025
Malicious code in concurrently-transhumanism-selenium-fork (npm)
- Aug 14, 2025
Malicious code in concurrently-local-antares-materialize (npm)
- Aug 14, 2025
Malicious code in concurrently-centauri-planetology-archaeometry (npm)
- Aug 14, 2025
Malicious code in conagua (npm)
- Aug 14, 2025
Malicious code in comradefy (npm)
- Aug 14, 2025
Malicious code in compton (npm)
- Aug 14, 2025
Malicious code in compress-route-query-route-permission (npm)
- Aug 14, 2025
Malicious code in compress-process-sandbox-float-validate (npm)
Page 6071 of 7,293